Mubit Powered BLUE 870 路径遍历漏洞

Mubit Powered BLUE 870 is a DNS server from Mubit Japan. A path traversal vulnerability exists in Mubit Powered BLUE 870 version 0.20130927 and earlier, which stems from path traversal and could lead to arbitrary file disclosure...

CVE-2025-54959: Improper Limitation of a Pathname to a Restricted Directory

Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected product may be disclosed...

PT-2025-32346 · Unknown · Powered Blue Server

Name of the Vulnerable Software and Affected Versions: Powered BLUE Server versions 0.20130927 and prior Description: Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability that could lead to the disclosure of arbitrary files within the affected product...

glpi-inventory-plugin 安全漏洞

glpi-inventory-plugin is a GLPI open source GLPI inventory plugin. A security vulnerability exists in glpi-inventory-plugin versions prior to 2.0.2, which stems from a file disclosure vulnerability in the /ajax/screenshot.php endpoint...

XtremIO Management Server Unauthorized Access

The vulnerability of the XtremIO Management Server XMS on the Dell XtremIO storage platform involves the disclosure of information through log files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2014-125125

CVE-2014-125125 describes a path traversal flaw in A10 Networks AX Loadbalancer (versions 2.6.1-GR1-P5, 2.7.0, and earlier) where the filename parameter in the /xml/downloads endpoint is not properly sanitized. An unauthenticated attacker can craft HTTP requests with directory traversal sequences...

📄 Ilevia EVE X1 Server 4.7.18.0.eden File Disclosure

Ilevia EVE X1 Server versions 4.7.18.0.eden and below suffer from an unauthenticated file disclosure vulnerability. Using the dblog POST parameter, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information. Ilevia EVE X1 Server 4.7.18.0.eden dblog...

Ilevia EVE X1 Server 4.7.18.0.eden (db_log) Pre-Auth File Disclosure

Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...

Metasploit Wrap-Up 07/25/2025

We want to hear from you! Over the next few weeks, we’ll continue to put out user surveys on X as well as Mastodon so you can respond to some of the questions that will help us understand what you want and need from Metasploit Framework! We will also have a survey on our website during DEF CON an...

NewStart CGSL MAIN 7.02 : librsvg2 Vulnerability (NS-SA-2025-0127)

The remote NewStart CGSL host, running version MAIN 7.02, has librsvg2 packages installed that are affected by a vulnerability: - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files on the local filesystem outside ...

WordPress plugin AI Engine 信息泄露漏洞

WordPress AI Engine is a plugin based on OpenAI technology, which is mainly used to integrate artificial intelligence features into WordPress websites to improve the efficiency of content generation, automated operations and so on. WordPress AI Engine suffers from an information disclosure...

Directory Traversal

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Directory Traversal via the restorerunbackup function. An attacker can overwrite critical system files or application configurations by writing arbitrary files to the...

ViewVC 路径遍历漏洞

ViewVC is ViewVC open source a Web-based CVS, SVN code repository browsing tool. A path traversal vulnerability exists in ViewVC versions 1.1.0 to 1.1.31 and 1.2.0 to 1.2.3, which stems from a directory traversal in the standalone.py script, which could lead to the disclosure of the contents of t...

VulnCheck KEV: CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

CVE-2025-34119

A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens for a custom protocol where opcode 0x43 can be used to request arbitrary files by absolute path. If the file exists and is accessible, its...

CVE-2025-34118

A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/',...

XML External Entity (XXE) Injection

org.dspace, dspace-api is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of XML input during archive import and interaction with external services, which allows an attacker to craft malicious XML payloads that may lead to sensitive file disclosure o...

CVE-2025-53622

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.4, 8.2, and 9.1, a path traversal vulnerability is possible during the import of an archive in Simple Archive Format, either from command-line ./dspace import command ...

CVE-2025-34119

A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens for a custom protocol where opcode 0x43 can be used to request arbitrary files by absolute path. If the file exists and is accessible, its...

CVE-2025-34119

CVE-2025-34119 affects EasyCafe Server 2.2.14. A remote, unauthenticated file-disclosure exists via a custom protocol on TCP port 831, using opcode 0x43 to request files by absolute path. If the targeted file exists, its contents are returned without authentication, potentially exposing system co...