CVE-2021-4472

CVE-2021-4472 affects the OpenStack Mistral ecosystem, specifically the mistral-dashboard plugin and related python-mistralclient. A local file inclusion (LFI) vulnerability via the Create Workbook feature could disclose arbitrary local file contents. Public advisories confirm this issue across d...

CVE-2021-4472 Python-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' feature

The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content...

CVE-2021-4472

The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content...

CVE-2025-66263 Unauthenticated Arbitrary File Read via Null Byte Injection

Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in downloadsetting.php allows reading arbitrary files...

CVE-2025-66263

The CVE-2025-66263 entry describes an unauthenticated arbitrary file read due to a null byte injection in the Mozart FM Transmitter’s download_setting.php. The PHP code appends a forced .tgz extension to user-supplied $_GET['filename'], and on PHP 5.3.2 (pre-5.3.4) the null byte (%00) terminates ...

EUVD-2025-199670

Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in downloadsetting.php allows reading arbitrary files...

CVE-2025-34350

Summary : CVE-2025-34350 affects UnForm Server

Exploit for CVE-2024-58258

CVE‑2024‑58258 – SugarCRM SSRF & Local File Disclosure Abo...

TencentOS Server 3: pki-core (TSSA-2022:0269)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0269 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 3: openwsman (TSSA-2022:0094)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0094 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Lynx Twonky Server 安全漏洞

Lynx Twonky Server is a DLNA/UPnP media server from Lynx USA. A security vulnerability exists in Lynx Twonky Server version 8.5.2, which stems from an access control flaw that could lead to log file disclosure and administrator credential disclosure...

Mozilla Firefox < 68.10.1

The version of Firefox installed on the remote Windows host is prior to 68.10.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2020-27 advisory. - A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leadi...

CVE-2016-15056 Ubee EVW3226 Unauthenticated Backup File Disclosure

Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for download. These backup files remain accessible without authentication until the next reboot. A remote attacker on the local network can reque...

CVE-2016-15056

The CVE affects Ubee EVW3226 cable modem/router firmware up to 1.0.20. A configuration backup file (Configuration_file.cfg) is stored in the web root after generation and remains accessible without authentication until the next reboot, enabling a local-network attacker to retrieve the backup arch...

CVE-2023-7327

Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Successful exploitation allows an unauthenticated attacker to use URL-encoded traversal sequences to read arbitrary files from the underlying filesystem with the privileges of the gateway service,...

CVE-2016-15055

CVE-2016-15055 affects JVC VN-T IP-camera models with firmware up to 2016-08-22 (confirmed on VN-T216VPRU). The vulnerability is a directory traversal in the /checkcgi endpoint that accepts a user-controlled file parameter. An unauthenticated remote attacker can leverage this to read arbitrary fi...

Arbitrary Client-Side File Disclosure

aiomysql is vulnerable to Arbitrary Client-Side File Disclosure. The vulnerability is due to the client not validating server requests for local files, and attackers can exploit this by running a rogue MySQL server that sends LOADLOCAL packets to request and retrieve arbitrary files from the clie...

PT-2025-46733

Name of the Vulnerable Software and Affected Versions Ozeki SMS Gateway versions up to and including 10.3.208 Description Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal issue. A successful exploit allows an unauthenticated attacker to read arbitrary files from th...

KB5068861: Windows 11 Version 24H2 / Windows Server 2025 / Windows 11 Version 25H2 Security Update (November 2025)

The remote Windows host is missing security update 5068861 or hotpatch 5068966. It is, therefore, affected by multiple vulnerabilities - Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. CVE-2025-62208,...

OESA-2025-2618 python-aiomysql security update

aiomysql is a "driver" for accessing a MySQL database from the asyncio PEP-3156/tulip framework. It depends on and reuses most parts of PyMySQL . aiomysql tries to be like awesome aiopg library and preserve same api, look and feel. Security Fixes: aiomysql is a library for accessing a MySQL...