17 matches found
UBUNTU-CVE-2026-72814
The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...
CVE-2026-72814 actix-files before 0.6.10 Information Disclosure via Files
The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...
CVE-2026-72814
The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...
CVE-2026-72814 actix-files before 0.6.10 Information Disclosure via Files
The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...
Actix Web path traversal vulnerability
Versions of Actix Web prior to 0.6.10 contain a path traversal vulnerability. This vulnerability stems from improper path handling; when an invalid folder is passed as the servefrom parameter to Files::new, the mount path defaults to an empty path, causing the request path to be interpreted as a...
PT-2026-8391
Summary When passing a non-existing folder to the actix files::Files::new method causes the actix server to expose unexpected files. Details The actix-files library exposes a Files struct that configures an actix service to serve the files in a folder as static assets. Below you can find the...
CVE-2022-3284
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...
CVE-2022-3284
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...
CVE-2022-3284
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...
Information disclosure
Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3...
Design/Logic Flaw
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...
CVE-2022-3284 Insecure way of passing a download key
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...
CVE-2022-3284 Insecure way of passing a download key
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...
CVE-2022-4862: Exposure of Sensitive Information to an Unauthorized Actor
Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3...
PT-2023-15884
Name of the Vulnerable Software and Affected Versions M-Files Web versions prior to 22.12.12140.3 M-Files New Web versions prior to 22.12.12140.3 Description The issue allows rendering of HTML provided by another authenticated user in the browser, which can lead to the theft of user sensitive...
PT-2023-13204
Name of the Vulnerable Software and Affected Versions M-Files New Web versions prior to 22.11.12011.0 Description The download key for a file in a vault was passed in an insecure manner, making it easily loggable. This issue may potentially affect a significant number of devices worldwide, althou...
CVE-2022-3284: Exposure of Sensitive Information to an Unauthorized Actor
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...