CVE-2022-46492

nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability via the component /api/Index/getFileBinary...

CVE-2022-46768 File name information disclosure vulnerability in Zabbix Web Service Report Generation

Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files...

CVE-2022-45388

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system...

CVE-2022-41917 Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries to return a...

CVE-2022-43449

OpenHarmony v3.1.2 and earlier are affected by an Arbitrary file read via the download_server component. The download_server service runs with UID 1000, allowing a local attacker to install a malicious app and read any filesystem file accessible to the service. The description across connected so...

Debian: Security Advisory (DLA-3147-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-20887 · Vmware · Vmware Aria Operations

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations affected versions not specified Description: The issue allows a malicious actor with administrative privileges to read arbitrary files containing sensitive data. Recommendations: At the moment, there is no information...

CVE-2021-40694

Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account...

CVE-2022-41235

CVE-2022-41235 applies to the Jenkins WildFly Deployer Plugin, affected through version 1.0.2 and earlier. The vulnerability allows an agent process to read arbitrary files on the Jenkins controller filesystem due to its path traversal/read-access behavior. The available documents do not specify ...

ShirneCMS 路径遍历漏洞

ShirneCMS is an open source backend management system of Shirne Software Shirnecn. ShirneCMS version 1.2.0 has a path traversal vulnerability. Attackers use this vulnerability to read arbitrary files via /static/ueditor/php/controller.php...

CVE-2022-36082

mangadex-downloader is a command-line tool to download manga from MangaDex. When using file: command and is a web URL location http, https, mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains...

CVE-2022-35235 WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerability

Authenticated admin+ Arbitrary File Read vulnerability in XplodedThemes WPide plugin = 2.6 at WordPress...

CVE-2022-28710

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

Metasploit Weekly Wrap-Up

Putting in the work! This week we’re extra grateful for the fantastic contributions our community makes to Metasploit. The Metasploit team landed more than 5 PRs each from Ron Bowes and bcoles, adding some great new capabilities. Ron Bowes contributed four new modules targeting UnRAR, Zimbra, and...

IBM DataPower Gateway 代码问题漏洞

IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B, and cloud workloads. The platform protects, integrates, and optimizes access across channe...

WordPress MultiSafepay plugin for WooCommerce Arbitrary File Read Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. An arbitrary file read vulnerability exists in the WordPress MultiSafepay plugin for WooCommerce 4.13.1 and prior versions, which stems from...

EUVD-2022-36938

Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin = 4.13.1 at WordPress...

CVE-2022-33901 WordPress MultiSafepay plugin for WooCommerce plugin <= 4.13.1 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin = 4.13.1 at WordPress...

PT-2022-20753 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP plugin versions = 2.20.2 Description: The issue is related to an authenticated arbitrary file read vulnerability via the export function in the GiveWP plugin for WordPress. This vulnerability can be exploited by users with a custom...

Cisco Unified Communications Manager File Read (cisco-sa-cucm-imp-afr-YBFLNyzd)

The version of Cisco Unified Communications Manager Unified CM installed on the remote host is prior to 14SU2. It is, therefore, affected by a file read vulnerability. Due to insufficient file permissions, an authenticated remote attacker could read arbitrary files on the underlying operating...