1407 matches found
CVE-2024-1594 Local File Read via Path Traversal in mlflow/mlflow
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component in the artifact location URI to read arbitrary files on the...
CVE-2024-1561: Path Traversal: '\..\filename'
An issue was discovered in gradio-app/gradio, where the /componentserver endpoint improperly allows the invocation of any method on a Component class with attacker-controlled arguments. Specifically, by exploiting the moveresourcetoblockcache method of the Block class, an attacker can copy any fi...
PT-2024-18132
Name of the Vulnerable Software and Affected Versions gradio-app/gradio affected versions not specified Description An issue was discovered in gradio-app/gradio, where the "/component server" endpoint improperly allows the invocation of any method on a Component class with attacker-controlled...
CVE-2023-46181
IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 269686...
CVE-2023-46181
CVE-2023-46181 affects IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0. The issue allows web pages to be stored locally and read by another user on the same system (information disclosure). Remediation: upgrade to IBM Sterling Secure Proxy iFix 11 (for 6.0.3) or iFix 03 (for 6.1.0) per IBM. Ot...
CVE-2024-2045
Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...
Session fixation
Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...
CVE-2024-2045
The CVE-2024-2045 entry concerns Session version 1.17.5. Affected component: Local File Read via chat attachments, enabling retrieval of internal application files and public files from a user’s device without consent. This is a Local attack (LOCAL) requiring user interaction. Descriptions from m...
CVE-2024-2045 Session 1.17.5 - LFR via chat attachment
Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...
CVE-2024-2045 Session 1.17.5 - LFR via chat attachment
Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...
CVE-2024-2045 Session 1.17.5 - LFR via chat attachment
Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...
CVE-2024-2045: Improper Limitation of a Pathname to a Restricted Directory
Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...
PT-2024-18665 · Session · Session
Name of the Vulnerable Software and Affected Versions: Session version 1.17.5 Description: The application is vulnerable to Local File Read via chat attachments, allowing internal application files and public files from the user's device to be obtained without the user's consent. Recommendations:...
CVE-2022-25377
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. This pathname is automatically created if...
PT-2024-11533 · Appwrite · Appwrite
Name of the Vulnerable Software and Affected Versions: Appwrite versions 0.5.0 through 0.12.x before 0.12.2 Description: The issue allows remote attackers to read arbitrary local files via ../ directory traversal in the "ACME-challenge" endpoint. This vulnerability requires the existence of APP...
CVE-2024-1648 electron-pdf 20.0.0 - Local File Read via Server Side XSS
electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
CVE-2024-1647 pyhtml2pdf 0.0.6 - Local File Read via Server Side XSS
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
CVE-2024-1647 pyhtml2pdf 0.0.6 - Local File Read via Server Side XSS
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...