CVE-2019-11020

Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visiting easily guessable dashboard/uploads/claimfiles/claimid URLs...

tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. For the vulnerability to be...

[SECURITY] Fedora 41 Update: qgis-3.40.5-2.fc41

Geographic Information System GIS manages, analyzes, and displays databases of geographic information. QGIS supports shape file viewing and editing, spatial data storage with PostgreSQL/PostGIS, projection on-the-fly, map composition, and a number of other features via a plugin interface. QGIS al...

CVE-2024-9617

An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file...

CVE-2024-7043

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all...

CVE-2024-7043 Improper Access Control in open-webui/open-webui

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all...

CVE-2024-9617

Summary: CVE-2024-9617 describes an Insecure Direct Object Reference in danswer-ai/danswer v0.3.94 where an attacker can view any user file via GET /api/chat/file/{file_id} due to missing ownership checks. Details from connected docs: • Vulnerable component: Danswer application (v0.3.94). • Root ...

CVE-2025-29768

A flaw was found in Vim's zip.vim plugin. This vulnerability allows potential data loss via specially crafted zip files when a user views the archive in Vim and presses 'x' on an unusual filename. Mitigation Mitigation for this issue is either not available or the currently available options do n...

Unauthorized Access

Mattermost is vulnerable to unauthorized access. The vulnerability is due to a lack of proper access restrictions in the Mattermost application, allowing members of a channel to view files that they should not have permission to access...

Atos Unify OpenScape Security Vulnerability

Atos Unify OpenScape is a native SIP-based real-time Voice over IP system from Atos Unify. A security vulnerability exists in Atos Unify OpenScape Voice V10 versions prior to V10R3.26.1, which stems from a directory traversal vulnerability in the SOAP server that allows an attacker to view the...

CVE-2023-47140

IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls...

IBM CICS Transaction Gateway 安全漏洞

IBM CICS Transaction Gateway is a connector for modernizing enterprise CICS assets from International Business Machines IBM. An access control error vulnerability exists in IBM CICS Transaction Gateway version 9.3, which can be exploited by an attacker to transfer or view files...

CVE-2023-6353 Tyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypass

Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.aspx 'enky' parameter...

Tyler Technologies Magistrate Court Case Management Plus Authorization Issue Vulnerability

Tyler Technologies Magistrate Court Case Management Plus is a district court case management system from Tyler Technologies. A security vulnerability exists in Tyler Technologies Magistrate Court Case Management Plus. A remote attacker could use this vulnerability to upload, delete, and view file...

PT-2023-32622 · Tyler Technologies · Tyler Technologies Civil/Criminal Electronic Filing

Name of the Vulnerable Software and Affected Versions: Tyler Technologies Civil and Criminal Electronic Filing affected versions not specified Description: The issue allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the 'enky' parameter in the Upload.asp...

PT-2023-32623 · Tyler Technologies · Magistrate Court Case Management Plus

Name of the Vulnerable Software and Affected Versions: Tyler Technologies Magistrate Court Case Management Plus affected versions not specified Description: The issue allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the filename parameter in the...

PT-2023-8658 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Better PDF Exporter for Jira Server and Jira Data Center versions 10.3.0 and before Description: The issue is related to insufficient server-side request validation in the Better PDF Exporter plugin for Atlassian Jira Server and Data Center...

ZKTeco BioAccess IVS Path Traversal Vulnerability

ZKTeco BioAccess IVS is a lite web-based security platform from ZKTeco, China. A path traversal vulnerability exists in ZKTeco BioAccess IVS v3.3.1, which stems from the program's failure to properly filter special elements in the path of a resource or file, and can be exploited by an attacker to...

ManageEngine ADManager Plus < Build 7183 XXE

Zoho ManageEngine ADManager Plus before version 7.1 Build 7183 allows authenticated administrators to perform XML external entity injection XXE attacks and view files in servers. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

Milesight UR32L 路径遍历漏洞

The Milesight UR32L is a 4G industrial router from China's Milesight. The Milesight UR32L suffers from a directory traversal vulnerability that can be exploited by an attacker to view arbitrary files on the system by sending a specially crafted URL request containing a "dot dot" sequence /.../. /...