6005 matches found
CVE-2021-31232
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack...
CVE-2021-31232
The CVE-2021-31232 issue affects Cortex’s Alertmanager before version 1.8.1. Root cause: when -experimental.alertmanager.enable-api is enabled, the HTTP basic auth password_file can be used as an attack vector to leak any file content via a webhook, and Alertmanager templates can load any text fi...
CVE-2021-31231
The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The...
CVE-2021-31231
The CVE affects Grafana Enterprise Metrics versions before 1.2.1 and Grafana Metrics Enterprise 1.2.1. It is a local file disclosure vulnerability triggered when experimental.alertmanager.enable-api is enabled. The HTTP basic auth password_file can be exploited to exfiltrate any file content via ...
PT-2021-19211 · Grafana · Grafana Enterprise Metrics +1
Name of the Vulnerable Software and Affected Versions: Grafana Enterprise Metrics versions prior to 1.2.1 Metrics Enterprise version 1.2.1 Description: The issue allows for local file disclosure when the experimental.alertmanager.enable-api is used. The HTTP basic auth password file can be...
PT-2021-19212 · Cncf · Cncf Cortex
Name of the Vulnerable Software and Affected Versions: CNCF Cortex versions prior to 1.8.1 Description: The issue concerns a local file disclosure problem in the Alertmanager component when the -experimental.alertmanager.enable-api option is enabled. This allows an attacker to potentially send an...
CVE-2020-21994
AVE DOMINAplus =1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated attacker to issue a request to an unprotected directory that hosts an XML file '/xml/authClients.xml' and obtain administrative login information that allows for a successful...
wordpress 5.7 授权XXE漏洞（CVE-2021-29447）
WordPress 5.7 XXE Vulnerability BY KARIM EL OUERGHEMMI|APRIL 26, 2021 At SonarSource, we are constantly improving our code analyzers and security rules. We recently improved our PHP security engine to detect more OWASP Top 10 and CWE Top 25 issue types. When testing our new analyzers against some...
CloudBees Jenkins Config File Provider Plugin Privilege Checking Vulnerability (CNVD-2021-31659)
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Config File Provider Plugin is used in one of...
Design/Logic Flaw
Discord-Recon is a bot for the Discord chat service. In versions of Discord-Recon 0.0.3 and prior, a remote attacker is able to read local files from the server that can disclose important information. As a workaround, a bot maintainer can locate the file app.py and add .replace'..', '' into the...
CVE-2021-29466 Path Traversal at Discord-Recon .recon Command Path
Discord-Recon is a bot for the Discord chat service. In versions of Discord-Recon 0.0.3 and prior, a remote attacker is able to read local files from the server that can disclose important information. As a workaround, a bot maintainer can locate the file app.py and add .replace'..', '' into the...
CVE-2021-29466
CVE-2021-29466 concerns Discord-Recon, a Discord bot. A path traversal vulnerability exists in versions ≤ 0.0.3, allowing a remote attacker to read local server files due to improper handling of path traversal sequences. The documented workaround was to modify the recon function’s Path variable b...
Mohamed Dief Discord-Recon 路径遍历漏洞
Mohamed Dief Discord-Recon is a Mohamed Dief open source application. It is used to perform the reconnaissance process b from Discord. A security vulnerability exists in Discord-Recon version 0.0.3 and earlier versions, which can be exploited by remote attackers to be able to read local files fro...
SUSE: Security Advisory (SUSE-SU-2019:0656-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Patreon WordPress Local File Disclosure Vulnerability
Patreon is a subscription-based crowdfunding platform and Patreon WordPress is a WordPress plugin for the platform. A local file disclosure vulnerability exists in Patreon WordPress versions prior to 1.7.0. An attacker can exploit the vulnerability to obtain internal files such as database...
CVE-2021-24227
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials a...
CVE-2021-24227
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials a...
Arbitrary file deletion
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials a...
CVE-2021-24227 Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials a...