CVE-2024-35431

CVE-2024-35431 affects ZKTeco ZKBio CVSecurity (versions around 6.1.1, with reports up to 6.4.1) via the photoBase64 parameter. Root cause: directory traversal allows an unauthenticated attacker to download local server files. Impact: confidentiality of server data is HIGH; no integrity/availabil...

CVE-2024-28826

Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...

CVE-2024-28826 Unrestricted upload and download paths in check_sftp

Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...

CVE-2024-28826 Unrestricted upload and download paths in check_sftp

Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...

Apache Flink Improper Access Control Vulnerability

Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface...

PT-2024-4721 · Unknown · Сервис Обновлений

Name of the Vulnerable Software and Affected Versions: Сервис обновлений affected versions not specified Description: The issue is related to the SOAP request handler in the "Сервис обновлений" software, which lacks authentication attempt limits. This can be exploited by a remote attacker to gain...

PT-2024-4724 · Ооо 'Кейсистемс' · Сервис Оправдательных Документов

Name of the Vulnerable Software and Affected Versions: Сервис оправдательных документов affected versions not specified Description: The issue is related to incorrect restriction of directory path names. It may allow a remote attacker to gain read access to local files. Recommendations: At the...

PT-2024-4720 · Microsoft · Net Core

Name of the Vulnerable Software and Affected Versions: .NET Core versions affected versions not specified Description: The issue is related to an incorrect restriction of directory path names in the .NET Core software component "Сервис обновлений". This could allow a remote attacker to gain read...

PT-2024-4728 · Ооо 'Кейсистемс' · Сервис Оправдательных Документов

Name of the Vulnerable Software and Affected Versions: Сервис оправдательных документов affected versions not specified Description: The issue is related to incorrect restriction of directory path names. It may allow a remote attacker to gain read and write access to local files. Recommendations:...

CVE-2023-41825

A path traversal vulnerability was reported in the Motorola Ready For application that could allow a local attacker to access local files...

CVE-2023-41825

A path traversal vulnerability was reported in the Motorola Ready For application that could allow a local attacker to access local files...

CVE-2023-41825

A path traversal vulnerability was reported in the Motorola Ready For application that could allow a local attacker to access local files...

CVE-2023-34283 NETGEAR RAX30 USB Share Link Following Information Disclosure Vulnerability

NETGEAR RAX30 USB Share Link Following Information Disclosure Vulnerability. This vulnerability allows physically present attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw...

XML External Entity (XXE)

scrapy is vulnerable to XML External Entity XXE. The vulnerability is due to the lxml.etree.fromstring function which lacks input validation, enabling attackers to execute denial of service attacks, access local files, create network connections, or bypass firewalls through specially crafted XML...

Duplicate Advisory: Scrapy decompression bomb vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7j7m-v7m3-jqm7. This link is maintained to preserve external references. Original Description The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring fo...

CVE-2024-3572

The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, ...

CVE-2024-3572

The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, ...

CVE-2024-3572 XML External Entity (XXE) Vulnerability in scrapy/scrapy

The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, ...

CVE-2024-3572 XML External Entity (XXE) Vulnerability in scrapy/scrapy

The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, ...

CVE-2024-3572

The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, ...