TYPO3 Path Traversal Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from TYPO3 Association in Switzerland. A path traversal vulnerability exists in TYPO3 version 11.5.24. An attacker could use this vulnerability to read arbitrary files via the Baseuri field using directory traversal...

Jira Server/Data Center Limited Remote File Read (CVE-2021-26086)

Binary data jiracve-2021-26086.nbin...

MercadoLibre: Account Takeover / Arbitrary File read and deletion / Partial code execution (intent redirection)

The vulnerability allowed for account takeover, arbitrary file read and deletion, and partial code execution through intent redirection. MercadoLibre acknowledged the issue and worked on a fix internally...

Dell Virtual Appliance Manager Arbitrary File Read Vulnerability

Dell Virtual Appliance Manager is a virtual appliance manager from Dell USA. An arbitrary file read vulnerability exists in Dell Virtual Appliance Manager, which can be exploited by an attacker to read arbitrary files from the target system...

Dell Virtual Appliance Manager Arbitrary File Read Vulnerability (CNVD-2024-0018759)

Dell Virtual Appliance Manager is a virtual appliance manager from Dell USA. An arbitrary file read vulnerability exists in Dell Virtual Appliance Manager, which can be exploited by an attacker to read arbitrary files from the target system...

Arbitrary File Read Vulnerability in Damon Qizi Conference Data Visualization System (DMQZDV Experience Edition) of Wuhan Damon Database Co.

Damon Qiji big data visualization system is a one-stop tool platform for big data display. An arbitrary file read vulnerability exists in the Damon Qizi Big Data Visualization System DMQZDV Experience Edition of Wuhan Damon Database Co...

Arbitrary File Read Vulnerability in Damon Enterprise Manager

Damon Enterprise Manager is a centralized management platform that monitors, manages and maintains DM databases through a web interface. An arbitrary file read vulnerability exists in Damon Enterprise Manager, which can be exploited by attackers to obtain sensitive information...

CVE-2023-50264

Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system...

CVE-2023-50265

Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...

Design/Logic Flaw

Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system...

Design/Logic Flaw

Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...

CVE-2023-50265 Bazarr Arbitrary file read in /api/swaggerui/static endpoint

Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...

CVE-2023-50265 Bazarr Arbitrary file read in /api/swaggerui/static endpoint

Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...

CVE-2023-50265

Bazarr prior to 1.3.1 contains an arbitrary file read in /api/swaggerui/static because the user‑supplied filename is passed to send_file in bazarr/app/ui.py without validation. Affects Bazarr versions before 1.3.1; fixed in 1.3.1. Impact: potential read of arbitrary files on the server. Remediati...

CVE-2023-50264 Bazarr Arbitrary file read in /system/backup/download/ endpoint

Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system...

CVE-2023-50264 Bazarr Arbitrary file read in /system/backup/download/ endpoint

Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system...

ALPINE-CVE-2023-49294

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the livedangerously is not enabled. This allows arbitrary fil...

CVE-2023-49294

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the livedangerously is not enabled. This allows arbitrary fil...

CVE-2023-49294 Asterisk Path Traversal vulnerability

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the livedangerously is not enabled. This allows arbitrary fil...

CVE-2023-49294 Asterisk Path Traversal vulnerability

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the livedangerously is not enabled. This allows arbitrary fil...