PT-2025-1161 · Microsoft · Windows Digital Media +1

Name of the Vulnerable Software and Affected Versions: Windows Digital Media affected versions not specified Description: The issue is related to an elevation of privilege in Windows Digital Media, which can be exploited to gain system-level privileges. It involves a memory reading vulnerability...

PT-2025-1250

Name of the Vulnerable Software and Affected Versions Windows Digital Media affected versions not specified Description The issue is related to a component of Windows Digital Media and involves a memory reading error beyond the allowed range. This can potentially allow an attacker to elevate thei...

PT-2025-1118

Name of the Vulnerable Software and Affected Versions Windows Digital Media affected versions not specified Description The issue is related to an elevation of privilege in Windows Digital Media, which can be exploited to allow an attacker to elevate their privileges. It involves a memory reading...

Teamcenter Visualization Siemens Tecnomatix Plant Simulation Heap Buffer Overflow

The vulnerability of the Teamcenter Visualization lifecycle management system and the Siemens Tecnomatix Plant Simulation software environment related to simulation modeling involves reading data beyond the acceptable range in memory. Exploiting this vulnerability could allow an attacker to execu...

CVE-2024-12806

A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file...

CVE-2024-12806

SonicWall SonicOS is affected by a post-authentication absolute path traversal vulnerability in its management interface. An authenticated remote attacker can exploit this flaw to read arbitrary files on the system. There is currently no evidence of this vulnerability being exploited in the wild....

CVE-2024-12806

A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file...

CVE-2024-10585 InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading

The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the /debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory...

CVE-2024-10585 InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading

The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the 'historyID' parameter of the /debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory...

CVE-2024-35532

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...

CVE-2024-35532

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...

CVE-2024-35532

An XML External Entity (XXE) injection vulnerability exists in Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14 . This flaw allows an attacker to perform arbitrary file reading under the privileges of the running process, initiate SSRF requests , or trigger a Denial of Service (DoS) via...

Mitel MiCollab Path Traversal Vulnerability

Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server...

PT-2025-2443

Name of the Vulnerable Software and Affected Versions: Intersec Geosafe-ea versions 2022.12 through 2022.14 Description: The issue allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified...

CVE-2024-35532: Out-of-bounds Read

An XML External Entity XXE injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service DoS via unspecified vectors...

WordPress plugin Dynamics 365 Integration 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

Summary This is a POC for a path-sanitizer npm package. The filters can be bypassed and can result in path traversal. Payload: ..=%5c can be used to bypass this on CLI along with other candidates. Something similar would likely work on web apps as well. PoC Here's the code to test for the filter...

PT-2025-34424

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains an issue where invalid file types within inodes were not properly checked during the reading process. This could lead to malfunctions or assertion failures...

Security update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative

This update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative fixes the following issues: CVE-2024-47535: Fixed unsafe reading of large environment files when Netty is loaded by a java application can lead to a crash due to the JVM memory limit being exceeded in netty...

GHSA-C9F5-29F6-C35W Browsershot Improper Input Validation vulnerability

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note:...