CVE-2022-32974

An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without providing any valid SSH credentials...

Vulnerabilities fixed in Tenable Nessus Agent

Vulnerabilities have been fixed in Tenable Nessus Agent. The vulnerabilities allow a malicious person with elevated privileges to able to execute arbitrary code under administrator privileges and the read arbitrary files on the underlying system. Tenable has released a new version of Nessus Agent...

SafeNet KeySecure Management 路径遍历漏洞

SafeNet KeySecure Management is a secure software package from SafeNet USA. A security vulnerability exists in SafeNet KeySecure Management that stems from an improper restriction of pathnames in restricted directories. An authenticated attacker could read arbitrary files from the underlying syst...

CVE-2022-29014

A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to read arbitrary files...

CVE-2022-29014

A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to read arbitrary files...

Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

The 1 FileService.importFileByInternalUserId and 2 FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file...

GHSA-PRC3-7F44-W48J Missing XML Validation in Apache Tomcat

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to 1 read arbitrary files via a crafted web application that provides an XML external entity...

GHSA-GPHJ-63H8-R9VQ Moodle directory traversal vulnerability

Directory traversal vulnerability in the mingetslashargument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter, as demonstrated ...

PT-2022-18090

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 16.1.2.2 F5 BIG-IP versions prior to 15.1.5.1 F5 BIG-IP versions prior to 14.1.4.6 F5 BIG-IP versions prior to 13.1.5 F5 BIG-IP versions 12.1.x and 11.6.x Description Directory traversal vulnerabilities exist in...

GHSA-JG55-3Q6H-2CCF Typo3 Backend XSS Vulnerability

An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided files, allows a remote attacker to read arbitrary files on a host. The expected value of a mandatory hash secret, intended to invalidate such requests, is exposed to remote users allowing...

GHSA-HM8G-JXJJ-GFM3 Zope allows remote attackers to read arbitrary files

The docutils module in Zope Zope2 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText reST markup, which allows remote attackers to read arbitrary files via a csvtable directive, a different vulnerability than CVE-2006-3458...

GHSA-VX77-5PF4-C9WR CherryPy Directory traversal vulnerability

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors...

workflow-cps: Pipeline-related plugins follow symbolic links or do not limit path names

A flaw was found in Jenkins. The Pipeline: Groovy Plugin follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file typically Jenkinsfile for Pipelines. This flaw allows attackers who can configure Pipelines to read arbitrary files on...

PT-2022-3580 · Siemens · Sicam A8000 Cp-8050 +1

Name of the Vulnerable Software and Affected Versions: SICAM A8000 CP-8031 versions prior to V4.80 SICAM A8000 CP-8050 versions prior to V4.80 Description: A vulnerability has been identified that allows unauthenticated attackers to access certain files without requiring user authentication. This...

CVE-2022-28543

Path traversal vulnerability in Samsung Flow prior to version 4.8.07.4 allows local attackers to read arbitrary files as Samsung Flow permission...

CVE-2021-44138: Improper Limitation of a Pathname to a Restricted Directory

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request...

CVE-2022-28160

Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller...

PT-2022-18859 · Jenkins · Jenkins Tests Selector Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Tests Selector Plugin version 1.3.3 and earlier Description: The issue allows users with Item/Configure permission to read arbitrary files on the Jenkins controller. Recommendations: For Jenkins Tests Selector Plugin version 1.3.3 and...

CVE-2022-27208

Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller...

CVE-2022-27203: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller...