SUSE CVE-2023-34457

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took...

UBUNTU-CVE-2023-37203

Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files. This could have been leveraged to execute arbitrary code. This vulnerability affects Firefox 115...

MechanicalSoup 输入验证错误漏洞

MechanicalSoup is a Python library for automating interactions with websites. An input validation error vulnerability exists in MechanicalSoup version 0.2.0 through versions prior to 1.3.0, which originates from a malicious web server that can read arbitrary files on a client using an HTML form...

June 27, 2023—KB5027303 (OS Build 22621.1928) Preview

None None...

Fortinet FortiNAC 命令注入漏洞

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is primarily used for network access control and IoT security. Fortinet FortiNAC suffers from a command injection vulnerability that stems from the presence of a command injection...

FortiNAC - argument injection in XML interface on port tcp/5555

An improper neutralization of special elements used in a command 'command injection' vulnerability CWE-77 in FortiNAC tcp/5555 service may allow an unauthenticated attacker to copy local files of the device to other local directories of the device via specially crafted input fields. To access the...

CVE-2023-3256

Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files...

PT-2023-3612 · Advantech · Advantech R-Seenet

Name of the Vulnerable Software and Affected Versions: Advantech R-SeeNet version 2.4.22 Description: The issue is related to incorrect external control of a file name or path, allowing a remote attacker to gain unauthorized access to local files by sending specially crafted HTTP requests. This c...

CVE-2023-26435

It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limite...

Open redirect

It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as well as including local files with read permissions of the open-xchange system user. This was limite...

Open-Xchange App Suite 代码问题漏洞

Open-Xchange AppSuite is a set of Web cloud desktop environments from Open-Xchange Germany. The environment allows users to manage email, tasks, files, etc. more intuitively. A code issue vulnerability exists in Open-Xchange App Suite that stems from the ability to call file system and network...

CVE-2023-28603

Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions...

Improper access control

Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions...

CVE-2023-28603

CVE-2023-28603 concerns the Zoom VDI client installer, with an improper access control flaw in versions prior to 5.14.0. The vulnerability could allow a malicious user to delete local files without proper permissions. Affected component: Zoom VDI client installer (pre-5.14.0). Root cause: imprope...

CVE-2023-28603

Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions...

NETGEAR RAX30 USB Share Link Following Information Disclosure Vulnerability

This vulnerability allows physically present attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of symbolic links on removable USB media. By...

CVE-2023-28161

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, suc...

CVE-2023-28161

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, suc...

CVE-2023-3031

Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15...

CVE-2023-3031 Prestahop module King-Avis - Path traversal

Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15...