3315 matches found
CVE-2020-14160
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources...
PT-2021-9700
Name of the Vulnerable Software and Affected Versions Gotenberg versions through 6.2.1 Description A Server-Side Request Forgery SSRF issue exists in the remote URL to PDF conversion, allowing a remote attacker to read local files or fetch intranet resources. Recommendations For Gotenberg version...
GHSA-4VHW-4RW7-JFPV Path traversal in mozwire
An issue was discovered in the mozwire crate through 2020-08-18 for Rust. A ../ directory-traversal situation allows overwriting local files that have .conf at the end of the filename...
Samsung SmartThings security vulnerabilities
SAMSUNG SmartThings is an app from South Korea's Samsung SAMSUNG that connects smart devices. A security vulnerability exists in SAMSUNG SmartThings versions prior to 1.7.67.25, which stems from the application allowing untrusted programs to include local files in the webview...
CVE-2021-37469
In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem...
CVE-2019-12086
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint, the service has the mysql-connector-java jar 8.0.14 or earlier in the classpath, and an...
Xxe
The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of local files over the network via an XXE attack...
CVE-2021-28684
The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of local files over the network via an XXE attack...
bloofoxCMS path traversal vulnerability (CNVD-2021-41076)
bloofoxCMS is a free open source PHP + MySQL based Web content management system . A path traversal vulnerability exists in the fileurl parameter in bloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability to read local files...
CVE-2020-35762
bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files...
CVE-2020-35762
bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files...
PT-2021-11854
Name of the Vulnerable Software and Affected Versions: bloofoxCMS version 0.5.2.1 Description: The issue allows attackers to read local files due to Path traversal in the fileurl parameter. Recommendations: For bloofoxCMS version 0.5.2.1, avoid using the fileurl parameter until the issue is...
CVE-2021-25405
An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files...
CVE-2021-25405
An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files...
CVE-2021-25405
An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files...
Improper access control
An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files...
CVE-2021-25405
An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files...
PT-2021-16596
Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.2.04.27 Description: An improper access control issue in ScreenOffActivity allows untrusted applications to access local files. Recommendations: For versions prior to 4.2.04.27, update to version 4.2.04.27 or...
Cross site scripting
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and...
WS-2021-0112
In 'xml2xlsx' PyPi module version 1.0.1 is vulnerable to XML External Entity vulnerability as the function xml2xlsx does not restrict external entities while parsing the specially crafted XML document. Due to this flaw an attacker could read local files by defining an external entity with a file:...