1267 matches found
HGiga PowerStation 安全漏洞
HGiga PowerStation is a network load balancing system from China Henderson HGiga. A security vulnerability exists in HGiga PowerStation, which stems from a chroot restriction bypass that could lead to privileged users accessing the entire file system...
CVE-2025-24249
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to check the existence of an arbitrary path on the file system...
NVIDIA Container Toolkit 1.16.1 Breakout
NVIDIA Container Toolkit versions 1.16.1 and below contain a Time-of-check Time-of-Use TOCTOU vulnerability when used with a default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful...
CVE-2024-10210
CVE-2024-10210 affects the B&R APROL APROL Web Portal prior to version 4.4-005P. The vulnerability is an External Control of File Name or Path, allowing an authenticated network-based attacker to access data from the file system. The CVE entry lists a CVSS v4.0 base score of 8.4 (HIGH) with NETWO...
CVE-2024-10210 Path traversal in APROL Web Portal
An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL 4.4-005P may allow an authenticated network-based attacker to access data from the file system...
B&R Industrial Automation B&R APROL 安全漏洞
B&R Industrial Automation B&R APROL is a process control system from B&R Industrial Automation, Austria. A security vulnerability exists in B&R Industrial Automation B&R APROL versions prior to 4.4-005P, which originates from an external control of file names or paths in the APROL Web Portal, and...
CVE-2024-8537
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling t...
CVE-2024-10835
CVE-2024-10835 affects eosphoros-ai/db-gpt v0.6.0. The web API endpoint POST /api/v1/editor/sql/run allows executing arbitrary SQL without access control, enabling Arbitrary File Write via DuckDB SQL and potentially Remote Code Execution (RCE). Affected component: DB-GPT web API handler for edito...
CODESYS Control 路径遍历漏洞
CODESYS Control is a suite of industrial control program programming software from CODESYS, Germany. CODESYS Control suffers from a path traversal vulnerability that stems from insufficient path validation, which could allow a low-privileged attacker to gain full file system access...
CVE-2024-54449
The CVE-2024-54449 entry describes a flaw in LogicalDOC’s document API where two endpoints allow an authenticated user (with read/write on an existing document) to write arbitrary files to the server’s filesystem, enabling potential remote code execution. Affected component: the document-manageme...
Esri ArcGIS Server Catalog Traversal Vulnerability
Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A directory traversal vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by a remote authenticated attacker to access files outside the file syst...
Linux Distros Unpatched Vulnerability : CVE-2017-5454
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker...
Linux Distros Unpatched Vulnerability : CVE-2019-3835
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this...
CVE-2024-51958 Directory traversal vulnerability in the admin api for service thumbnails
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or...
webkitgtk: A maliciously crafted webpage may be able to fingerprint the user
A flaw was found in WebKitGTK. A maliciously crafted web page may be able to fingerprint the user due to improper access restrictions to the file system...
webkitgtk: A maliciously crafted webpage may be able to fingerprint the user
A flaw was found in WebKitGTK. A maliciously crafted web page may be able to fingerprint the user due to improper access restrictions to the file system...
Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro
Summary If untrusted user input is used to dynamically create a PebbleTemplate with the method PebbleEnginegetLiteralTemplate, then an attacker can include arbitrary local files from the file system into the generated template, leaking potentially sensitive information into the output of...
CVE-2025-27098 Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh
GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...
CVE-2025-27098 Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh
GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...
