ExpressionEngine Security Vulnerability

Packet Tide ExpressionEngine is an open source content management system CMS from Packet Tide, Inc. in the United States. A security vulnerability exists in ExpressionEngine that stems from insufficient user input filtering, which allows an unauthenticated attacker to read arbitrary files and cau...

CVE-2024-30420

Server-side request forgery SSRF vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain...

TECNO com.transsion.videocallenhancer 安全漏洞

TECNO com.transsion.videocallenhancer is a cell phone component from TECNO China. A security vulnerability exists in TECNO com.transsion.videocallenhancer version 1.1.9.973, which originates from improper control of interface privileges, resulting in a risk of private file disclosure...

endroid/qr-code-bundle File Disclosure via logo_path query parameter

Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logopath query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure...

GHSA-MVF6-3F2G-XFXF endroid/qr-code-bundle File Disclosure via logo_path query parameter

Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logopath query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure...

CVE-2024-3484

Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure...

CVE-2024-3484

Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure...

CVE-2024-3484

CVE-2024-3484 affects OpenText iManager 3.2.6.0200 and is a path traversal vulnerability that can lead to privilege escalation or file disclosure. The available connected documents confirm the affected product and the underlying issue (path traversal) but do not provide concrete exploit details o...

CVE-2024-3484 Path Traversal vulnerability found in iManager

Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure...

PT-2024-40382 · Unknown · Endroid/Qr-Code-Bundle

Name of the Vulnerable Software and Affected Versions: endroid/qr-code-bundle versions prior to 3.4.2 Description: The issue arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure through the logo path query parameter. Recommendations: For...

PT-2024-25693

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.46 Description A low privilege user account with page edit privilege can read any server files using Twig Syntax, including Grav user account files - /grav/user/accounts/.yaml, which stores hashed user password, 2FA...

CVE-2024-3484: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure...

NetIQ iManager 路径遍历漏洞

NetIQ iManager is an advanced web-based management console from NetIQ UK. Customized secure access to network management utilities and content can be provided from any location in the world. A security vulnerability exists in NetIQ iManager version 3.2.6.0200, which stems from the presence of pat...

CVE-2024-3546: Missing Authorization

The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpmgdppopulatepopup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above...

Gradio 安全漏洞

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. A security vulnerability exists in Gradio that stems from an endpoint incorrectly allowing any method on a class to be called, allowing unauthorized read access to local...

CVE-2023-48710: Files or Directories Accessible to External Parties

iTop is an IT service management platform. Files from the env-production folder can be retrieved even though they should have restricted access. Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. The pages/exec.php script as been...

CVE-2024-1790: Improper Limitation of a Pathname to a Restricted Directory

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.0.1 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrar...

PT-2024-18463 · WordPress · Ht Mega – Absolute Addons For Elementor

Name of the Vulnerable Software and Affected Versions: HT Mega – Absolute Addons For Elementor plugin for WordPress versions prior to 2.4.7 Description: The issue allows authenticated attackers with contributor access or higher to read the contents of arbitrary files on the server, potentially...

WordPress ConvertKit plugin <= 2.4.5 - Email Disclosure in Log File vulnerability

Email Disclosure in Log File vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin ConvertKit versions = 2.4.5...

CVE-2024-29225

ELECOM wireless LAN routers are vulnerable to an information disclosure vulnerability (CWE-200 ) where a network-adjacent unauthenticated attacker can obtain a configuration file containing sensitive information by sending a specially crafted request. This affects ELECOM WRC-G01-W versions 1.24 a...