CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Grafana未認証ファイル読み取り 影響バージョン：8.0.0-lastest reference: - https://github.com/tangxiaofeng7/Grafana-File-Read Grafanaの/public/pluginsインターフェースがURLルーティングの検証を厳密に行っていない脆弱性を利用して、サーバー上の任意のローカルファイルを読み取ります。 poc: /public/plugins/icon/../../../../../../../../../../../../../../../../../..path...

GrafTraverse-CVE-2021-43798

GrafTraverse - CVE-2021-43798 簡易エクスプロイトフレームワーク Grafana ディレクトリトラバーサル CVE-2021-43798 の許可されたセキュリティテストのためのコマンドライン自動化ツール 概要 CVE-2021-43798 は、Grafana 8.x における認証なしのディレクトリトラバーサル脆弱性です。攻撃者は /public/plugins/ エンドポイントを介して、基盤となるファイルシステム上の任意のファイルを読み取ることができます。根本原因は、プラグインアセットリクエストにおけるパスサニタイズが不適切で、../...

CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...

EUVD-2026-72924

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type min, max, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records replacing them with...

EUVD-2026-64339

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely...

EUVD-2026-64338

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader bypasses the fix for CVE-2026-54292...

EUVD-2026-64337

NLTK: Stable FrameNet and NKJP readers parse outside-root XML...

CVE-2024-20767

CVE-2024-20767 の概念実証スクリプト 概要 get-the-files.py は、Adobe ColdFusion サーバー（CVE-2024-20767）の脆弱性を悪用して、サーバーからファイルを読み取る Python スクリプトです。このスクリプトは、https://jeva.cc/2973.html で概説されている方法に基づいています。 免責事項...

CVE-2026-79572

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

EUVD-2026-72917

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

CVE-2026-82074

CVE-2026-82074 is an incorrect authorization vulnerability in the MongoDB Server aggregation framework . An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what i...

Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

EUVD-2026-72916

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

CVE-2026-82066

A heap out-of-bounds read vulnerability exists in the query planning component of MongoDB Server . An authenticated user with database read and write privileges can trigger the issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The leaked...

EUVD-2026-72953

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...

CVE-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...

Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...

EUVD-2026-72951

A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about...

Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members

A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about...