WordPress plugin AI ChatBot path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2023-45277

Yamcs 5.8.6 is vulnerable to directory traversal issue 1 of 2. The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files...

PT-2023-29765 · Wipotec Gmbh · Comscale

Name of the Vulnerable Software and Affected Versions: WIPOTEC GmbH ComScale versions 4.3.29.21344 through 4.4.12.723 Description: The issue allows unauthenticated attackers to read files from the underlying operating system and obtain directory listings due to a failure in validating user...

Ivanti Endpoint Manager Code Issue Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti USA. A security vulnerability exists in Ivanti Endpoint Manager 2022 SU3 and prior versions, which stems from a vulnerability that allows an attacker to read and disclose files on the server and perform elevation of...

The vulnerability of the FileMgmtExport class in the Advanced Core Operating System (ACOS) controller A10 Thunder ADC allows a hacker to read and delete any files they desire.

The vulnerability of the FileMgmtExport class in the Advanced Core Operating System ACOS controller A10 Thunder ADC lies in an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability allows a malicious actor to read and delete any files at will from...

Server-side Request Forgery (SSRF)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the injection of arbitrary URLs. An attacker can read files outside the application's path boundary by forcing...

Improper Input Validation

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Input Validation due to improper handling of input validation. An attacker can read arbitrary files from the file system by exploiting the privileges of an...

Adobe Commerce Input Validation Error Vulnerability

Adobe Commerce is a leading global digital commerce solution for merchants and brands from Adobe. An input validation error vulnerability exists in Adobe Commerce prior to version 2.4.7, which stems from being affected by an incorrect input validation vulnerability that could allow an attacker...

Sangfor Next-Gen Application Firewall Security Vulnerabilities

Sangfor Next-Gen Application Firewall Sangfor NGAF is an application firewall from China-based Sangfor. A security vulnerability exists in Sangfor Next-Gen Application Firewall NGAF version 8.0.17, which allows an authenticated attacker to read arbitrary system files using the svpnhtml/loadfile.p...

PT-2023-18923 · Synology · Music Station

Name of the Vulnerable Software and Affected Versions: Music Station versions prior to 5.3.22 Description: A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose...

PT-2023-18924 · Synology · Music Station

Name of the Vulnerable Software and Affected Versions: Music Station versions prior to 5.3.22 Description: A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow authenticated users to read the contents of unexpected files and expose...

PT-2023-8511 · Qnap · Qnap Qts +2

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.5.2645 build 20240116 QNAP QuTS hero versions prior to h5.1.5.2647 build 20240118 QNAP QuTScloud versions prior to c5.1.5.2651 Description: A path traversal vulnerability has been reported to affect several QNAP...

CVE-2023-43256

A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input...

CVE-2023-38344

An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an...

Skyworth OS Path Traversal Vulnerability

Skyworth OS is an operating system from Skyworth, a Chinese company. A path traversal vulnerability exists in Skyworth OS version 3.0. An attacker could exploit this vulnerability to read arbitrary files on the server running the application...

CVE-2023-20194

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This...

CVE-2023-41635

A XML External Entity XXE vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to read any file in the filesystem via supplying a crafted XML file...

PT-2023-27354

Name of the Vulnerable Software and Affected Versions Apache Airflow Spark Provider versions prior to 4.1.3 Description The issue allows an attacker to pass in malicious parameters when establishing a connection, giving an opportunity to read files on the Airflow server. Recommendations For...

The vulnerability of Blink’s web page rendering mechanism in Google Chrome browser allows a hacker to read and write arbitrary files in the system.

The vulnerability of Blink’s web page rendering mechanism in Google Chrome browsers is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to read and write arbitrary files on the system using a specially crafted HTML page...

PYSEC-2023-136

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read file...