908 matches found
CVE-2020-20948
An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...
The vulnerability of the WISE-4060 Ethernet module’s microprogramming software, related to the unencrypted storage of confidential information, allows a perpetrator to gain full access to the device’s configuration files.
The vulnerability of the WISE-4060 Ethernet module’s microprogramming software is related to the unencrypted storage of confidential information. Exploiting this vulnerability could allow an attacker to gain full access to the device’s configuration files...
Grafana 5.0.0 - 8.3.1 Directory Traversal Vulnerability
Grafana is prone to a directory traversal vulnerability for Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
CVE-2021-43831
Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access an...
CVE-2021-41066
An issue was discovered in Listary through 6. When Listary is configured as admin, Listary will not ask for permissions again if a user tries to access files on the system from Listary itself it will bypass UAC protection; there is no privilege validation of the current user that runs via Listary...
SAP NetWeaver Directory Traversal (CVE-2016-3976)
A directory traversal vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...
CVE-2021-40095
An issue was discovered in SquaredUp for SCOM 5.2.1.6654. The Download Log feature in System / Maintenance was susceptible to a local file inclusion vulnerability when processing remote input in the log files downloaded by an authenticated administrator user, leading to the ability to read...
Path Traversal
librenms/librenms is vulnerable to path traversal. The library does not properly encode the $currentconfig attribute in showconfig.inc.php, allowing an attacker to access files outside the expected directory through the $url field...
PortlandLabs Concrete CMS 安全漏洞
PortlandLabs Concrete Cms is a team-oriented open source content management system from PortlandLabs, Inc. PortlandLabs Concrete CMS has a security vulnerability that could be exploited by attackers to access restricted files...
CVE-2021-31349
The usage of an internal HTTP header created an authentication bypass vulnerability CWE-287, allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to...
CVE-2021-40109
A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents...
Authentication flaw
The issue was addressed with improved permissions logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. An application may allow shortcuts to access restricted files...
CVE-2021-30947
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, iOS 15.2 and iPadOS 15.2, watchOS 8.3. An application may be able to access a user's files...
CVE-2021-30947
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, iOS 15.2 and iPadOS 15.2, watchOS 8.3. An application may be able to access a user's files...
Apple macOS Big Sur 后置链接漏洞
Apple macOS Big Sur is a mobile application app from Apple USA. A security vulnerability exists in various Apple products that originates from an authentication issue in the handling of symbolic links. The application can be exploited to access restricted files. The issue is fixed in Catalina, iO...
Code injection
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server...
CVE-2021-25445
Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsung Internet...
QSAN Storage Manager 后置链接漏洞
QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A security vulnerability exists in QSAN Storage Manager, which can be exploited by remote attackers to create symbolic links and then access arbitrary files...
Information Disclosure
libvirt is vulnerable to information disclosure. An attacker is able to access files of other users when the system generates SELiinux MCS category pairs for VMs' dynamic labels...