CVE-2024-50629

Summary: CVE-2024-50629 affects Synology BeeStation OS (BSM) and DiskStation Manager (DSM). The vulnerability is in the webapi component and arises from improper encoding or escaping of output, allowing remote attackers to read limited files via unspecified vectors. Affected products/versions inc...

CVE-2024-45779 Grub2: fs/bfs: integer overflow leads to heap oob read in the bfs parser

An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a he...

CVE-2025-20051

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards...

CVE-2022-25737

Information disclosure in modem due to missing NULL check while reading packets received from local network...

CVE-2024-6250

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the openfile endpoint of lollmsadvanced.py. The sanitizepath function with allowabsolutepath=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can...

CVE-2024-45627 Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be...

PT-2025-1251 · Microsoft · Windows Digital Media +1

Name of the Vulnerable Software and Affected Versions: Windows Digital Media affected versions not specified Description: The issue is related to a component of Windows Digital Media and involves a memory reading vulnerability that can allow an attacker to elevate their privileges. This can...

PT-2025-1161 · Microsoft · Windows Digital Media +1

Name of the Vulnerable Software and Affected Versions: Windows Digital Media affected versions not specified Description: The issue is related to an elevation of privilege in Windows Digital Media, which can be exploited to gain system-level privileges. It involves a memory reading vulnerability...

CVE-2024-21547

CVE-2024-21547 affects the PHP package spatie/browsershot prior to 5.0.2 . The vulnerability is a Directory Traversal flaw caused by URI normalization in the browser where the file:// check can be bypassed using **file:**, allowing an attacker to read arbitrary server files by exploiting normaliz...

Adobe Commerce Improper Input Validation Vulnerability (CNVD-2024-41454)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. An improper input validation vulnerability exists in Adobe Commerce, which can be exploited by an attacker to read files from the system outside of the...

PT-2024-41092 · Netalertxnetalertx +3 · * +1

Name of the Vulnerable Software and Affected Versions: NetAlertX versions 24.7.18 through 24.10.12 Description: The issue allows unauthenticated file reading due to factors related to strpos and directory traversal, where an HTTP client can ignore a redirect. This is related to components/logs.ph...

PT-2024-08: Reading arbitrary files when scanning a project linked to a git repository in PT Application Inspector (PT AI)

The vulnerability was identified in PT AI affecting versions 4.3.1 to 4.7.2. The vulnerability can be exploited by an attacker with network access to the PT AI control server to read source code files of other user's projects. The vulnerability can be exploited for privilege escalation...

CVE-2024-36423 GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/public-chatflows/id endpoint. If the default configuration is used unauthenticated, an attacker may be able to...

Mozilla Firefox post-release reuse vulnerability (CNVD-2024-29333)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A post-release reuse vulnerability exists in versions prior to Mozilla Firefox 127, which can be exploited by an attacker to read memory in the JavaScript string portion of the heap...

CVE-2024-2548

A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the lollmscore/lollms/server/endpoints/lollmsbindingfilesserver.py and lollmscore/lollms/security.py files. Due to inadequate validation of file paths between Windows and Linux environments using...

CVE-2023-51006

An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors...

CVE-2023-51006

An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors...

CVE-2023-50968 Apache OFBiz: Arbitrary file properties reading and SSRF attack

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes th...

Improper restriction of XML external entity references (XXE) in Proself

Overview Proself provided by North Grid Corporation improperly restricts XML external entity references XXE CWE-611. The developer states that attacks exploiting this vulnerability have been observed. North Grid Corporation reported this vulnerability to JPCERT/CC to notify users of its solution...

CVE-2023-25608

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all...