Cisco Unified Communications Manager IM & Presence File Read Vulnerability (isco-sa-cucm-imp-afr-YBFLNyzd)

The version of Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P installed on the remote host is prior to 14SU2. It is, therefore, affected by a file read vulnerability. Due to insufficient file permissions, an authenticated remote attacker could read arbitrary files on t...

CVE-2022-20791

CVE-2022-20791 affects Cisco Unified Communications Manager (CUCM), Unified CM SME, and Unified CM IM&P. Root cause: insufficient file permission restrictions that allow an authenticated remote attacker to read arbitrary files on the underlying OS by sending a crafted command via the application ...

U.S. Dept Of Defense: Local file read at https://████/ [HtUS]

Heyy there, I have found local file read vulnerability in your website https://█████/ This the vulnerable endpoint https://██████████/download.php?filePathDownload=dataproducts and the filePathDownload path is vulnerable which allows an attacker to read any local files. There was some sort...

CVE-2022-32275

Grafana 8.4.3 allows reading files via for example a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content...

CVE-2022-29720

CVE-2022-29720 affects 74cmsSE v3.5.1. A vulnerability in index\controller\Download.php enables an arbitrary file read. Documented references confirm the component and location; no exploit details or remediation are provided in the supplied sources. If applicable, apply vendor advisories or patch...

CVE-2022-27983

The CVE-2022-27983 entry concerns RG-NBR-E Enterprise Gateway RG-NBR2100G-E, which contains an arbitrary file read vulnerability in the check.php URL parameter. The issue’s root cause is not fully detailed beyond this file-read flaw, and the connected sources confirm the affected product and vuln...

CVE-2022-24843 Path Traversal in github.com/flipped-aurora/gin-vue-admin

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for th...

CVE-2022-22279

A post-authentication arbitrary file read (path traversal) vulnerability impacts end-of-life Secure Remote Access (SRA) appliances and older firmware versions of Secure Mobile Access (SMA) 100 series products. Specifically, the vulnerability affects SRA appliances running all 8.x and 9.0.0.5-19sv...

HPE OneView 安全漏洞

A file read vulnerability exists in versions prior to HPE OneView 6.6, which stems from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit this vulnerability to cause local unauthorized file read access...

GHSA-8P4X-FQ8V-XHV4 Arbitrary file read vulnerability in Jenkins Continuous Integration with Toad Edge Plugin

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps...

USN-5348-1 smarty3 vulnerabilities

David Gnedt and Thomas Konrad discovered that Smarty was incorrectly sanitizing the paths present in the templates. An attacker could possibly use this use to read arbitrary files when controlling the executed template. CVE-2018-13982 It was discovered that Smarty was incorrectly sanitizing the...

Kubernetes: File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow

A vulnerability was found in AWS Prow that allowed attackers to sign the base path of S3 buckets used by Prow, leading to the dumping of the entire private bucket details and reading any file in the bucket. This could result in the compromise of S3 buckets containing production data...

CVE-2022-23621

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR for example xwiki.cfg and xwiki.properties through XWikiinvokeServletAndReturnAsString as...

CVE-2022-23316

taoCMS v3.0.2 contains an arbitrary file read vulnerability in the admin download path. The issue can be exploited via admin.php?action=file&ctrl=download&path=../../1.txt to read arbitrary files, indicating a path-traversal flaw in the file download handler. Impact centers on confidentiality (re...

CVE-2021-44351

CVE-2021-44351 affects NavigateCMS 2.9. The vulnerability is an arbitrary file read via /navigate/navigate_download.php id parameter due to improper validation in the navigate_download.php handler. The root cause is insufficient input validation of the id parameter in that file, enabling an attac...

TermTalk Server 3.24.0.2 Arbitrary File Read

Exploit Title: TermTalk Server 3.24.0.2 - Arbitrary File Read Unauthenticated Date: 03/01/2022 Exploit Author: Fabiano Golluscio @ Swascan Vendor Homepage: https://www.solari.it/it/ Software Link: https://www.solari.it/it/solutions/other-solutions/access-control/ Version: 3.24.0.2 Fixed Version:...

CVE-2021-44674

CVE-2021-44674 affects Opmantek Open-AudIT 4.2.0. The vulnerability is an information exposure via a path traversal issue that allows an authenticated attacker to read files outside of restricted directories. The NVD entry notes network access with low attack complexity and the ability to read re...

Exploit for CVE-2021-43008

CVE-2021-43008 - AdminerRead Exploit tool for Adminer 1...

Unpatched Unauthorized File Read Vulnerability Affects Microsoft Windows OS

Unofficial patches have been issued to remediate an improperly patched Windows security vulnerability that could allow information disclosure and local privilege escalation LPE on vulnerable systems. Tracked as CVE-2021-24084 CVSS score: 5.5, the flaw concerns an information disclosure...

The vulnerability of the “BKBCopyD.exe” service in Yokogawa’s software products allows a hacker to read arbitrary files using the RETR operation, write to arbitrary files using the STOR operation, or obtain confidential database location information using the PMODE operation.

The vulnerability of the “BKBCopyD.exe” service in Yokogawa’s software products is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to read arbitrary files using the RETR operation, write to arbitrary files using the STOR operation, or obtain...