PT-2025-3775 · Tata Consultancy Services · Tcs Bancs

Name of the Vulnerable Software and Affected Versions: TCS BaNCS version 10 Description: A vulnerability was found in TCS BaNCS, affecting an unknown part of the file /REPORTS/REPORTS SHOW FILE.jsp. The manipulation of the FilePath argument leads to file inclusion. The real existence of this...

PT-2024-17899 · Tsinghua Unigroup · Tsinghua Unigroup Electronic Archives Management System

Name of the Vulnerable Software and Affected Versions: Tsinghua Unigroup Electronic Archives Management System version 3.2.21080262532 Description: A vulnerability was found in the Tsinghua Unigroup Electronic Archives Management System. It has been classified as problematic and affects the...

CVE-2024-55657: Improper Limitation of a Pathname to a Restricted Directory

SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16...

CVE-2024-55657

CVE-2024-55657 affects Siyuan prior to version 3.1.16, where an arbitrary file read vulnerability exists in the /api/template/render endpoint due to insufficient path validation. The issue allows reading sensitive host files and is mitigated by upgrading to version 3.1.16, which includes a patch....

CVE-2024-55657 SiYuan has an arbitrary file read via /api/template/render

SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16...

GHSA-XX68-37V4-4596 SiYuan has an arbitrary file read via /api/template/render

Summary An arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Impact Arbitrary file read on the host...

SiYuan has an arbitrary file read via /api/template/render

Summary An arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Impact Arbitrary file read on the host...

PT-2024-36571 · Siyuan · Siyuan

Name of the Vulnerable Software and Affected Versions: SiYuan versions prior to 3.1.16 Description: An arbitrary file read issue exists due to the absence of proper validation on the path parameter in the "/api/template/render" endpoint. This allows attackers to access sensitive files on the host...

D-Link DI-8003 命令注入漏洞

The D-Link DI-8003 is a wireless router from China-based AUO D-Link. A command injection vulnerability exists in the D-Link DI-8003 version 16.07.16A1, which stems from the parameter path in the file /upgradefilter.asp failing to correctly filter construct command special characters, commands, et...

PT-2024-34882

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 5.5.0 Description The issue allows an attacker with access to the application to abuse File or UploadButton components and read arbitrary files from the application server. This is possible because the client utils.is...

CVE-2024-49359

CVE-2024-49359 affects ZimaOS (fork of CasaOS) prior to or including version 1.2.4. The vulnerability is a directory traversal in the API endpoint /v2_1/file, exploitable by an authenticated user who can manipulate the path parameter to list arbitrary directories (e.g., /etc) on the server. The r...

CVE-2024-44413

A vulnerability was discovered in DI8200-16.07.26A1, which has been classified as critical. This issue affects the upgradefilterasp function in the upgradefilter.asp file. Manipulation of the path parameter can lead to command injection...

PT-2024-31147 · Di 8200 · Di 8200

Name of the Vulnerable Software and Affected Versions: DI 8200 version 16.07.26A1 Description: A critical issue has been discovered, affecting the upgrade filter asp function in the upgrade filter.asp file. Manipulation of the path parameter can lead to command injection. Recommendations: For DI...

CVE-2024-44414: Improper Control of Generation of Code

A vulnerability was discovered in FBM292W-21.03.10V, which has been classified as critical. This issue affects the sub4901E0 function in the mspinfo.htm file. Manipulation of the path parameter can lead to command injection...

CVE-2024-44413

The D-Link DI_8200 enterprise router, specifically version 16.07.26A1 , is susceptible to a critical command injection vulnerability. The flaw exists within the upgrade_filter_asp function located in the upgrade_filter.asp file. An attacker can achieve command injection by manipulating the path p...

CVE-2024-44413: Improper Neutralization of Special Elements used in a Command

A vulnerability was discovered in DI8200-16.07.26A1, which has been classified as critical. This issue affects the upgradefilterasp function in the upgradefilter.asp file. Manipulation of the path parameter can lead to command injection...

CVE-2024-44413

A vulnerability was discovered in DI8200-16.07.26A1, which has been classified as critical. This issue affects the upgradefilterasp function in the upgradefilter.asp file. Manipulation of the path parameter can lead to command injection...

CVE-2024-44414

A critical command injection vulnerability exists in the WayOS FBM_292W wireless router, specifically affecting version 21.03.10V . The flaw originates from the sub_4901E0 function within the msp_info.htm file. An attacker can exploit this by manipulating the path parameter , potentially leading ...

D-Link DI_8200 安全漏洞

The D-Link DI8200 is an enterprise router from China's AUO D-Link. The D-Link DI8200 suffers from a command injection vulnerability that originates from manipulation of the parameter path in the file upgradefilter.asp. No details of the vulnerability are provided at this time...

EsafeNet CDG SQL注入漏洞

EsafeNet CDG is a document security management system from EsafeNet. A SQL injection vulnerability exists in ESAFENET CDG V5, which originates from the fileId parameter of file/MultiServerBackService?path=1 that can lead to SQL injection...