CVE-2021-26639

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can use this vulnerability to leak all files in the server without logging in system...

WISA Smart Wing CMS 安全漏洞

WISA Smart Wing CMS is a content management system from the Korean company WISA. A security vulnerability exists in WISA Smart Wing CMS that stems from a lack of validation of input values for specific functions. A remote attacker could exploit the vulnerability to disclose all files in the serve...

PT-2022-23989 · Unknown · Opennebula

Name of the Vulnerable Software and Affected Versions: OpenNebula affected versions not specified Description: The issue allows files or directories to be accessible to external parties, enabling file discovery. This affects OpenNebula on Linux. Recommendations: At the moment, there is no...

Streamlit 路径遍历漏洞

Streamlit is a data-oriented Python application development framework from the Streamlit open source. A path traversal vulnerability exists in Streamlit versions prior to 1.11.1, which stems from being a data-oriented python application development framework, and users hosting Streamlit...

Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal Vulnerability

Exploit Title: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal Exploit Author: LiquidWorm Vendor: CAREL INDUSTRIES S.p.A. Product web page: https://www.carel.com Affected version: Firmware: A2.1.0 - B2.1.0 Application Software: 2.15.4A Software version: v16 13020200 Summary: pCO...

CVE-2022-31471

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files...

PT-2022-20749 · Untangle · Untangle

Name of the Vulnerable Software and Affected Versions: untangle versions 1.2.0 and earlier Description: untangle is a python library to convert XML data to python objects. It improperly restricts XML external entity references, allowing a remote unauthenticated attacker to read the contents of...

CVE-2022-1551 SP Project & Document Manager < 4.58 - Sensitive File Disclosure

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files...

Exploit for Path Traversal in Apache Http_Server

Mitigation-CVE-2021-41773- Shell Script to mitigate CVE-2021-4...

Exploit for Path Traversal in Apache Http_Server

Mitigation-CVE-2021-41773- Shell Script to mitigate CVE-2021-4...

Couchbase Server 日志信息泄露漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions prior to 7.0.4, which stems from a private key that can b...

Grafana -- Unauthorized file disclosure

Grafana Labs reports: On July 21, an internal security review identified an unauthorized file disclosure vulnerability in the Grafana Image Renderer plugin when HTTP remote rendering is used. The Chromium browser embedded in the Grafana Image Renderer allows for “printing” of unauthorized files i...

GitLab: Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net

NOTE! Thanks for submitting a report! Please note that initial triage is handled by HackerOne staff. They are identified with a HackerOne triage badge and will escalate to the GitLab team any. Please replace all the parenthesized sections below with the pertinent details. Remember, the more detai...

PT-2022-4534 · Zyxel · Zyxel Usg/Zywall Series +8

Name of the Vulnerable Software and Affected Versions: Zyxel USG FLEX 100W firmware versions 4.50 through 5.30 Zyxel USG FLEX 200 firmware versions 4.50 through 5.30 Zyxel USG FLEX 500 firmware versions 4.50 through 5.30 Zyxel USG FLEX 700 firmware versions 4.50 through 5.30 Zyxel USG FLEX 50W...

PT-2022-16401

Name of the Vulnerable Software and Affected Versions dompdf versions prior to 2.0.0 Description The issue concerns a chroot check bypass that could lead to the disclosure of png and jpeg files. It allows for external control of file name or path in the GitHub repository dompdf/dompdf...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

Arbitrary file deletion

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

CVE-2022-35403

CVE-2022-35403 affects Zoho ManageEngine SDP before 13008, SDP MSP before 10606, SupportCenter Plus before 11022, and Asset Explorer before 6977 (authenticated). The issue is an unauthenticated local file disclosure via ticket-creation email. Red Hat and Nessus entries corroborate affected versio...