PT-2022-20887 · Vmware · Vmware Aria Operations

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations affected versions not specified Description: The issue allows a malicious actor with administrative privileges to read arbitrary files containing sensitive data. Recommendations: At the moment, there is no information...

CVE-2021-40694

Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account...

CVE-2022-41235

CVE-2022-41235 applies to the Jenkins WildFly Deployer Plugin, affected through version 1.0.2 and earlier. The vulnerability allows an agent process to read arbitrary files on the Jenkins controller filesystem due to its path traversal/read-access behavior. The available documents do not specify ...

ShirneCMS 路径遍历漏洞

ShirneCMS is an open source backend management system of Shirne Software Shirnecn. ShirneCMS version 1.2.0 has a path traversal vulnerability. Attackers use this vulnerability to read arbitrary files via /static/ueditor/php/controller.php...

CVE-2022-36082

mangadex-downloader is a command-line tool to download manga from MangaDex. When using file: command and is a web URL location http, https, mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains...

CVE-2022-35235 WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerability

Authenticated admin+ Arbitrary File Read vulnerability in XplodedThemes WPide plugin = 2.6 at WordPress...

CVE-2022-28710

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

Metasploit Weekly Wrap-Up

Putting in the work! This week we’re extra grateful for the fantastic contributions our community makes to Metasploit. The Metasploit team landed more than 5 PRs each from Ron Bowes and bcoles, adding some great new capabilities. Ron Bowes contributed four new modules targeting UnRAR, Zimbra, and...

IBM DataPower Gateway 代码问题漏洞

IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B, and cloud workloads. The platform protects, integrates, and optimizes access across channe...

WordPress MultiSafepay plugin for WooCommerce Arbitrary File Read Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. An arbitrary file read vulnerability exists in the WordPress MultiSafepay plugin for WooCommerce 4.13.1 and prior versions, which stems from...

EUVD-2022-36938

Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin = 4.13.1 at WordPress...

CVE-2022-33901 WordPress MultiSafepay plugin for WooCommerce plugin <= 4.13.1 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin = 4.13.1 at WordPress...

PT-2022-20753 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP plugin versions = 2.20.2 Description: The issue is related to an authenticated arbitrary file read vulnerability via the export function in the GiveWP plugin for WordPress. This vulnerability can be exploited by users with a custom...

Cisco Unified Communications Manager IM & Presence File Read Vulnerability (isco-sa-cucm-imp-afr-YBFLNyzd)

The version of Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P installed on the remote host is prior to 14SU2. It is, therefore, affected by a file read vulnerability. Due to insufficient file permissions, an authenticated remote attacker could read arbitrary files on t...

Cisco Unified Communications Manager File Read (cisco-sa-cucm-imp-afr-YBFLNyzd)

The version of Cisco Unified Communications Manager Unified CM installed on the remote host is prior to 14SU2. It is, therefore, affected by a file read vulnerability. Due to insufficient file permissions, an authenticated remote attacker could read arbitrary files on the underlying operating...

CVE-2022-20791

CVE-2022-20791 affects Cisco Unified Communications Manager (CUCM), Unified CM SME, and Unified CM IM&P. Root cause: insufficient file permission restrictions that allow an authenticated remote attacker to read arbitrary files on the underlying OS by sending a crafted command via the application ...

U.S. Dept Of Defense: Local file read at https://████/ [HtUS]

Heyy there, I have found local file read vulnerability in your website https://█████/ This the vulnerable endpoint https://██████████/download.php?filePathDownload=dataproducts and the filePathDownload path is vulnerable which allows an attacker to read any local files. There was some sort...

CVE-2022-32275

Grafana 8.4.3 allows reading files via for example a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content...

CVE-2022-29720

CVE-2022-29720 affects 74cmsSE v3.5.1. A vulnerability in index\controller\Download.php enables an arbitrary file read. Documented references confirm the component and location; no exploit details or remediation are provided in the supplied sources. If applicable, apply vendor advisories or patch...

CVE-2022-27983

The CVE-2022-27983 entry concerns RG-NBR-E Enterprise Gateway RG-NBR2100G-E, which contains an arbitrary file read vulnerability in the check.php URL parameter. The issue’s root cause is not fully detailed beyond this file-read flaw, and the connected sources confirm the affected product and vuln...