CVE-2024-23540 HCL BigFix Inventory is vulnerable to path traversal

The HCL BigFix Inventory server is vulnerable to path traversal which enables an attacker to read internal application files from the Inventory server. The BigFix Inventory server does not properly restrict the served static file...

PT-2024-19931 · Hcl · Hcl Bigfix Inventory Server

Name of the Vulnerable Software and Affected Versions: HCL BigFix Inventory server affected versions not specified Description: The issue allows an attacker to perform path traversal, enabling them to read internal application files from the server. This is due to the server not properly...

PortSwigger Web Security: [portswigger.net] Path Traversal al /cms/audioitems

Vulnerability description not provided...

CVE-2023-49544

A local file inclusion LFI in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customersupport/index.php...

Session Path Traversal Vulnerability

Session is a new type of encrypted private messenger open-sourced by Oxen. A path traversal vulnerability exists in Session version 1.17.5. An attacker exploiting this vulnerability could obtain internal application files and public files from a user's device...

CVE-2024-26132 Element Android can be asked to share internal files.

Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through 1.6.12, to share files stored under the files directory in the application's private data directory to an arbitrary room. The impact of th...

Improper restriction of XML external entity references (XXE) in Electronic Deliverables Creation Support Tool provided by Ministry of Defense

Overview Electronic Deliverables Creation Support Tool provided by Ministry of Defense improperly restricts XML external entity references XXE CWE-611. Toyama Taku of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

JVN#77736613: Improper restriction of XML external entity references (XXE) in MLIT "Electronic Delivery Check System" and "Electronic delivery item Inspection Support System"

"Electronic Delivery Check System" and "Electronic delivery item Inspection Support System" provided by Ministry of Land, Infrastructure, Transport and Tourism, Japan improperly restricts XML external entity references XXE CWE-611. Impact Processing a specially crafted XML file may lead to exposu...

Electronic Delivery Check System Security Vulnerability

MAFF Electronic Delivery Check System is an electronic delivery check system from MAFF Japan. A security vulnerability exists in Electronic Delivery Check System Dentsu 18.1.0 and earlier, Dentsu 12.1.0 and earlier, Kikai 10.1.0 and earlier, which stems from the handling of specially crafted XML...

HackerOne: Server Side Request Forgery (SSRF) via Analytics Reports

We recently received a critical server-side request forgery SSRF vulnerability report through our bug bounty program. The issue allowed attackers to make internal requests from our application servers by exploiting a lack of output sanitization in an error message. By crafting malicious requests,...

JVN#14762986: Improper restriction of XML external entity references (XXE) in e-Tax software

e-Tax software provided by National Tax Agency improperly restricts XML external entity references XXE CWE-611 due to the configuration of the embedded XML parser. Impact Processing a specially crafted XML file may lead to exposure of internal files on the system. Solution Update the Software...

e-Tax Reception System Security Vulnerability

The e-Tax Reception System is an electronic tax management system organized by the National Tax Agency NTA of Japan. A security vulnerability exists in e-Tax Reception System version 3.0.10 and earlier, which stems from an improper restriction of XML External Entity References XXE, where processi...

CVE-2023-46502

An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory...

Server side request forgery (ssrf)

An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory...

Artifact Hub arbitrary file read vulnerability

Impact During a security audit of Artifact Hub's code base, a security researcher at OffSec identified a bug in which by using symbolic links in certain kinds of repositories loaded into Artifact Hub, it was possible to read internal files. Artifact Hub indexes content from a variety of sources,...

GHSA-HMQ4-C2R4-5Q8H Artifact Hub arbitrary file read vulnerability

Impact During a security audit of Artifact Hub's code base, a security researcher at OffSec identified a bug in which by using symbolic links in certain kinds of repositories loaded into Artifact Hub, it was possible to read internal files. Artifact Hub indexes content from a variety of sources,...

Artifact Hub Path Traversal Vulnerability

Artifact Hub is a web-based application that finds, installs, and distributes packages and configurations for CNCF projects. A security vulnerability exists in Artifact Hub that stems from the ability to read internal files through the use of symbolic links loaded into certain types of repositori...

CVE-2023-38750

In Zimbra Collaboration ZCS 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed...

PT-2023-26582 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 8.0.0 through 8.8.15 Patch 40 Zimbra Collaboration ZCS versions 9.0.0 through 9.0.0 Patch 33 Zimbra Collaboration ZCS versions 10.0.0 through 10.0.1 Description: Internal JSP and XML files can be exposed in...

PT-2023-24205 · Unknown · Omni-Notes

Name of the Vulnerable Software and Affected Versions: Omni-notes versions prior to 6.2.7 Description: The Omni-notes Android app has an issue with insufficient path validation when displaying note details received through an externally-provided intent. This allows malicious applications on the...