1236 matches found
PT-2022-6234 · Cisco · Cisco Identity Services Engine
Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive...
Vulnerability found in Microsoft Teams
Researchers from security firm Vectra have found a vulnerability found in the Microsoft Teams user application. The vulnerability allows a malicious party to obtain obtain authentication tokens from users and thereby perform actions with the victim's privileges. The vulnerability has not been...
PT-2022-23171 · Unknown · Mangadex-Downloader
Name of the Vulnerable Software and Affected Versions: mangadex-downloader versions 1.3.0 through 1.7.2 Description: The issue occurs when using the file: command with a web URL location, causing the mangadex-downloader to attempt to open and read a file on the local disk for each line of website...
mangadex-downloader 输入验证错误漏洞
mangadex-downloader is a command line tool for downloading comics from MangaDex by the individual developer Rahman Yusuf. An input validation error vulnerability exists in versions of mangadex-downloader prior to 1.7.2, which stems from an attempt to open and read a file on local disk for each li...
PT-2022-23209 · Blue Prism · Blue Prism Enterprise
Name of the Vulnerable Software and Affected Versions: Blue Prism Enterprise versions 6.0 through 7.01 Description: An issue was discovered in a misconfigured environment that exposes the Blue Prism Application server, allowing an authenticated user to reverse engineer the Blue Prism software and...
The vulnerability of the Passwork password manager lies in the improper restriction on the path name to the restricted catalog. This allows attackers to manipulate the URL parameters in order to gain access to local files and directories on the server.
The vulnerability of the Passwork password manager is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor, operating remotely, to manipulate URL parameters in order to gain access to local files and directories on th...
CVE-2022-2838
In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests...
Eclipse Sphinx 代码问题漏洞
Eclipse Sphinx is an extensible platform from the Eclipse Foundation that simplifies the creation of integrated modeling tool environments that support a single or multiple modeling languages which can be UML-based or native DSL, with a particular focus on industrial strength and interoperability...
wkhtmltopdf 路径遍历漏洞
wkhtmltopdf is wkhtmltopdf open source a library . Used to convert HTML to PDF. A security vulnerability exists in wkhtmltopdf version 0.12.5 and earlier versions. Remote attackers use this vulnerability to read local files and leak sensitive information through specially crafted html files...
USN-5182-1 roundcube vulnerabilities
It was discovered that Roundcube Webmail allowed JavaScript code to be present in the CDATA of an HTML message. A remote attacker could possibly use this issue to execute a cross-site scripting XSS attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM...
WordPress Plugin WSM Downloader 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2022-23634 · Samsung · Charm
Name of the Vulnerable Software and Affected Versions: Charm by Samsung versions prior to 1.2.3 Description: The issue allows local attackers to access files without permission via implicit intent, exploiting a PendingIntent hijacking vulnerability in the cancelAlarmManager function...
PT-2022-23633 · Samsung · Charm
Name of the Vulnerable Software and Affected Versions: Charm by Samsung versions prior to 1.2.3 Description: The issue allows local attackers to access files without permission via implicit intent, exploiting a PendingIntent hijacking vulnerability in the releaseAlarm function. Recommendations: F...
PT-2022-21832 · Samsung · Launcherprovider
Name of the Vulnerable Software and Affected Versions: LauncherProvider versions prior to SMR Aug-2022 Release 1 Description: The issue is related to improper access control and path traversal in LauncherProvider, allowing a local attacker to access files of One UI. Recommendations: For versions...
DEBIAN-CVE-2022-2160
Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from a user's local files via a crafted HTML page...
CVE-2022-2160
Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from a user's local files via a crafted HTML page...
U.S. Dept Of Defense: Local file read at https://████/ [HtUS]
Heyy there, I have found local file read vulnerability in your website https://█████/ This the vulnerable endpoint https://██████████/download.php?filePathDownload=dataproducts and the filePathDownload path is vulnerable which allows an attacker to read any local files. There was some sort...
CVE-2021-3779
A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later...
UBUNTU-CVE-2021-3779
A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later...