7351 matches found
Duplicate Advisory: Gradio Local File Inclusion vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m842-4qm8-7gpq. This link is maintained to preserve external references. Original Description gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied...
CVE-2024-1728
Gradio has a local file inclusion/path traversal vulnerability in the UploadButton component (affecting Gradio prior to 4.19.2). Attackers could read arbitrary files on the host (e.g., private keys) by manipulating the file path in requests to /queue/join, with potential remote code execution ris...
CVE-2024-1728 Local File Inclusion in gradio-app/gradio
gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in t...
CVE-2024-1728 Local File Inclusion in gradio-app/gradio
gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in t...
CVE-2024-1728 Local File Inclusion in gradio-app/gradio
gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in t...
Researchers Uncover First Native Spectre v2 Exploit Against Linux Kernel
Cybersecurity researchers have disclosed what they say is the "first native Spectre v2 exploit" against the Linux kernel on Intel systems that could be exploited to read sensitive data from the memory. The exploit, called Native Branch History Injection BHI, can be used to leak arbitrary kernel...
CVE-2024-29502: Improper Limitation of a Pathname to a Restricted Directory
An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths...
PT-2024-22928 · Unknown · Secure Lockdown Multi Application Edition
Name of the Vulnerable Software and Affected Versions: Secure Lockdown Multi Application Edition version 2.00.219 Description: An issue in the software allows attackers to read arbitrary files via using UNC paths. Recommendations: For Secure Lockdown Multi Application Edition version 2.00.219,...
CVE-2024-29502
An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths...
CVE-2024-29502
An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths...
CVE-2024-29502
An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files by using UNC paths . This vulnerability stems from an improper limitation of a pathname to a restricted directory (CWE-22 ). The impact includes unauthorized access to files, resulting in a Hi...
Path Traversal
github.com/mholt/archiver is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths within tar archives, allowing an attacker to craft a tar file that, when unpacked, can access or modify files or directories outside of the intended directory...
Easergy Studio Path Traversal
The vulnerability of the Easergy Studio software for configuring, monitoring, and controlling industrial equipment is related to the absence of quotation marks in the wording of elements or search paths. Exploiting this vulnerability can allow attackers to increase their privileges...
CVE-2024-26814
In the Linux kernel, the following vulnerability has been resolved: vfio/fsl-mc: Block calling interrupt handler without trigger The eventfdctx trigger pointer of the vfiofslmcirq object is initially NULL and may become NULL if the user sets the trigger eventfd to -1. The interrupt handler itself...
Local File Inclusion
voila is vulnerable to Local File Inclusion. The vulnerability is due to improper handling of file paths within app.py which allows an attacker to access readable files on the server's filesystem...
OpenSSH 安全漏洞
OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers from the Canadian OpenBSD Project Group. The tools are an open source implementation of the SSH protocol and support encryption of all transmissions, effectively blocking eavesdropping, connection...
Tukaani XZ Utils Installed (Linux / Unix)
Binary data xzutilsnixinstalled.nbin...
Internet Bug Bounty: Improper handling of wildcards in --allow-fs-read and --allow-fs-write
The Node.js Permission Model was found to have improper handling of wildcards in the --allow-fs-read and --allow-fs-write options. The implementation silently ignored any text after a wildcard character, potentially granting unintended file system access. Additionally, when the wildcard character...
PT-2024-2369 · Automationdirect · Automationdirect C-More Ea9 Hmi
Name of the Vulnerable Software and Affected Versions: AutomationDirect C-MORE EA9 HMI affected versions not specified Description: The issue is related to a function in the AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the...
