CVE-2022-24843 Path Traversal in github.com/flipped-aurora/gin-vue-admin

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for th...

CVE-2022-22279

CVE-2022-22279 describes a post-authentication arbitrary file read affecting end-of-life SonicWall SRA appliances (all 8.x and 9.0.0.5-19sv and earlier) and SMA 100 series firmware (9.0.0.9-26sv and earlier). The available sources do not specify the exact vulnerable component or root cause. Impac...

HPE OneView 安全漏洞

A file read vulnerability exists in versions prior to HPE OneView 6.6, which stems from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploit this vulnerability to cause local unauthorized file read access...

GHSA-8P4X-FQ8V-XHV4 Arbitrary file read vulnerability in Jenkins Continuous Integration with Toad Edge Plugin

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps...

USN-5348-1 smarty3 vulnerabilities

David Gnedt and Thomas Konrad discovered that Smarty was incorrectly sanitizing the paths present in the templates. An attacker could possibly use this use to read arbitrary files when controlling the executed template. CVE-2018-13982 It was discovered that Smarty was incorrectly sanitizing the...

Kubernetes: File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow

A vulnerability was found in AWS Prow that allowed attackers to sign the base path of S3 buckets used by Prow, leading to the dumping of the entire private bucket details and reading any file in the bucket. This could result in the compromise of S3 buckets containing production data...

CVE-2022-23621

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR for example xwiki.cfg and xwiki.properties through XWikiinvokeServletAndReturnAsString as...

CVE-2022-23316

taoCMS v3.0.2 contains an arbitrary file read vulnerability in the admin download path. The issue can be exploited via admin.php?action=file&ctrl=download&path=../../1.txt to read arbitrary files, indicating a path-traversal flaw in the file download handler. Impact centers on confidentiality (re...

CVE-2021-44351

CVE-2021-44351 affects NavigateCMS 2.9. The vulnerability is an arbitrary file read via /navigate/navigate_download.php id parameter due to improper validation in the navigate_download.php handler. The root cause is insufficient input validation of the id parameter in that file, enabling an attac...

TermTalk Server 3.24.0.2 Arbitrary File Read

Exploit Title: TermTalk Server 3.24.0.2 - Arbitrary File Read Unauthenticated Date: 03/01/2022 Exploit Author: Fabiano Golluscio @ Swascan Vendor Homepage: https://www.solari.it/it/ Software Link: https://www.solari.it/it/solutions/other-solutions/access-control/ Version: 3.24.0.2 Fixed Version:...

CVE-2021-44674

CVE-2021-44674 affects Opmantek Open-AudIT 4.2.0. The vulnerability is an information exposure via a path traversal issue that allows an authenticated attacker to read files outside of restricted directories. The NVD entry notes network access with low attack complexity and the ability to read re...

Exploit for CVE-2021-43008

CVE-2021-43008 - AdminerRead Exploit tool for Adminer 1...

Unpatched Unauthorized File Read Vulnerability Affects Microsoft Windows OS

Unofficial patches have been issued to remediate an improperly patched Windows security vulnerability that could allow information disclosure and local privilege escalation LPE on vulnerable systems. Tracked as CVE-2021-24084 CVSS score: 5.5, the flaw concerns an information disclosure...

The vulnerability of the “BKBCopyD.exe” service in Yokogawa’s software products allows a hacker to read arbitrary files using the RETR operation, write to arbitrary files using the STOR operation, or obtain confidential database location information using the PMODE operation.

The vulnerability of the “BKBCopyD.exe” service in Yokogawa’s software products is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to read arbitrary files using the RETR operation, write to arbitrary files using the STOR operation, or obtain...

Fortinet FortiPortal代码问题漏洞

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for use by MSPs. The vulnerability stems from an improper restriction of the XML external entity...

CVE-2021-32833 Unauthenticated file read in Emby Server

Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are...

Information disclosure

The vRealize Operations Manager API 8.x prior to 8.5 contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize Operations Manager API can read any arbitrary file on server leading to information disclosure...

CVE-2021-22022

Summary (CVE-2021-22022) : VMware vRealize Operations Manager API (versions 8.x before 8.5) contains an arbitrary file read vulnerability. An attacker with administrative access to the vROps API can read arbitrary files on the server, causing information disclosure. The issue is tied to the vROps...

CVE-2021-26086

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1...

CVE-2021-26085

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3...