1297 matches found
CVE-2022-26041
Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read or alter an arbitrary file on the server via unspecified vectors...
Arbitrary Code Injection
Overview convert-svg-core is a package that supports converting SVG into another format using headless Chromium. Affected versions of this package are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then...
Dragonfly 参数注入漏洞
Dragonfly is a framework that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly version v1.3.0, which can be exploited by an attacker to read and write arbitrary files...
XWiki Platform 路径遍历漏洞
Xwiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company Xwiki. A security vulnerability exists in versions of XWiki Platform prior to 12.10.3 that stems from the ability to request any file located in the class loader using the template API...
Mozilla Firefox Security Feature Bypass Vulnerability
Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges...
GHSA-WPMR-Q825-X4C6 aptdaemon Information Disclosure via Improper Input Validation in Transaction class
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an...
GHSA-MJWW-VQQW-V78Q WSO2 Carbon directory traversal vulnerability
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the logFile parameter to downloadgz-ajaxprocessor.jsp...
GHSA-8R28-R8CP-G6CP Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in t...
Apache Jena 代码问题漏洞
Apache Jena is a Java Semantic Web framework from the U.S. Apache Apache Foundation. It is used to build semantic Web and linked data applications. Apache Jena suffers from an XML external entity injection vulnerability, which stems from a Web system or product that does not set the correct filte...
PT-2022-3428 · Qnap · Quts Hero +2
Name of the Vulnerable Software and Affected Versions: QuTS hero versions prior to h4.5.4.1971 build 20220310 QuTS hero versions prior to h5.0.0.1986 build 20220324 QTS versions prior to 4.2.6 build 20220304 QTS versions prior to 4.3.3.1945 build 20220303 QTS versions prior to 4.3.4.1976 build...
SonicWall SSLVPN 路径遍历漏洞
SonicWALL SSLVPN is a transparent software application for Windows and Linux users from SonicWALL USA. It enables remote users to securely connect to the corporate network. A path traversal vulnerability exists in SonicWall SSLVPN, which allows an authenticated attacker to read arbitrary files...
Samsung Flow 路径遍历漏洞
Samsung flow is an application for Samsung Samsung mobile devices, a software used to connect Samsung to Win10 computers for a seamless, secure, and connected experience. path traversal vulnerability exists in versions prior to Samsung Flow 4.8.07.4, which stems from the lack of proper permission...
CVE-2021-41026
A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...
Jenkins Continuous Integration with Toad Edge Plugin 路径遍历漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building, deploying, and automating any project. An attacker with Item/Configure privileges can read arbitrary files on the...
The vulnerability of the Mozilla Firefox browser, related to access control deficiencies, allows attackers to gain access to confidential information.
The vulnerability of the Mozilla Firefox browser is related to access control deficiencies. Exploiting this vulnerability allows an attacker to read files from this folder and gain access to confidential information by reading files from the "/tmp" folder...
CVE-2022-25266
Passwork On-Premise Edition before 4.6.13 allows migration/downloadExportFile Directory Traversal to read files...
CVE-2022-25266
Passwork On-Premise Edition before 4.6.13 allows migration/downloadExportFile Directory Traversal to read files...
Directory traversal
Passwork On-Premise Edition before 4.6.13 allows migration/downloadExportFile Directory Traversal to read files...
CuppaCMS alertLightbox.php file contains vulnerabilities
CuppaCMS is a content management system CMS, and a file inclusion vulnerability exists in CuppaCMS version 1.0. The vulnerability stems from the fact that the url parameter in /alerts/alertLightbox.php does not effectively filter calls to local file resources, which could be exploited to read loc...