The vulnerability of the Apache Struts software platform, related to the use of files and directories accessible from external parties, allows a hacker to execute arbitrary code.

The vulnerability of the Apache Struts software platform is related to the use of files and directories accessible from external parties due to incorrect restrictions on the path to the restricted directory during file loading. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2023-49788 Improper handling of browser-side provided input in richdocuments path handling

Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server richdocumentscode is run without chroot sandboxing. Vulnerable versions of the richdocumentscode app can be susceptible to attac...

OESA-2023-1886 haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fixes: An information lea...

The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, arises from errors in processing the relative path to the catalog. This allows attackers to read arbitrary files.

The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, is related to errors in processing the relative path to the catalog. Exploiting this vulnerability allows an attacker, operating remotely, to read arbitrary files using specially creat...

kernel: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()

In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: fix refcount leak in pcigetdevwrapper As the comment of pcigetdomainbusandslot says, it returns a PCI device with refcount incremented, so it doesn't need to call an extra pcidevget in pcigetdevwrapper, and the PCI...

The vulnerability of the ShowTechDownloadView class in the Advanced Core Operating System (ACOS) controller A10 Thunder ADC allows a hacker to gain unauthorized access to protected information.

The vulnerability of the ShowTechDownloadView class in the Advanced Core Operating System ACOS controller A10 Thunder ADC is related to an incorrect path name limitation for access to restricted directories. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain...

PT-2024-13071 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 17 Apple iPadOS versions prior to 17 Apple macOS versions prior to Sonoma 14 Description: A path handling issue was addressed with improved validation, which may allow an app to break out of its sandbox...

The vulnerability of the TinyMCE plugin in the virtual training environment Moodle, which allows a hacker to gain access to read, modify, or delete data.

The vulnerability of the TinyMCE plugin in the virtual training environment Moodle is related to incorrect external management of file names or file paths during data loading. Exploiting this vulnerability can allow an attacker to gain access to, read, modify, or delete data by sending specially...

CVE-2023-2971

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text fro...

CVE-2023-2316

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious...

CVE-2023-2110

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies tex...

Design/Logic Flaw

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious...

CVE-2023-2971 Typora Local File Disclosure

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text fro...

CVE-2023-2971 Typora Local File Disclosure

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text fro...

CVE-2023-2971

CVE-2023-2971 describes a path handling vulnerability in Typora prior to 1.7.0-dev on Windows and Linux. A crafted webpage or malicious markdown content can trigger access to local files and exfiltration to remote servers via the endpoint typora://app/typemark/. The risk is supported by multiple ...

CVE-2023-2316 Typora Local File Disclosure

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious...

CVE-2023-2316 Typora Local File Disclosure

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious...

CVE-2023-2316

Typora (Windows/Linux) prior to 1.6.7 is affected by an improper path handling vulnerability that lets a crafted webpage access local files and exfiltrate them via the typora://app/ protocol. Exploitation can occur when a user opens a malicious Markdown file or pastes text from a malicious page, ...

CVE-2023-2110 Obsidian Local File Disclosure

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies tex...

CVE-2023-2110 Obsidian Local File Disclosure

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies tex...