QNAP Systems has multiple products with path traversal vulnerabilities

QNAP Systems QuTScloud and others are products of China's Weilian Technology QNAP Systems.QNAP Systems QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an operating system for entry- to mid-range QNAP NAS use. QNAP Systems QuTS hero is an operating syste...

Font Component Information Disclosure

The vulnerability of the Font component the default font used by Microsoft Edge and Google Chrome browsers is related to memory-related reading operations. Exploiting this vulnerability can allow an attacker to gain access to potentially confidential information from a remote location...

FreeRDP planar_skip_plane_rle RCE

The vulnerability of the planarskipplanerle function in the FreeRDP client is related to reading beyond the memory boundaries. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by this function...

Remote Access Connection Manager Disclosure

The vulnerability of the Remote Access Connection Manager in Windows operating systems is related to reading data beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...

nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

A flaw was found in Node.js due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which can allow an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and a denial of...

CVE-2024-31841

An issue was discovered in Italtel Embrace 1.6.4. The web server fails to sanitize input data, allowing remote unauthenticated attackers to read arbitrary files on the filesystem...

CVE-2024-23531

An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial of service attacks. In certain rare conditions this could also lead to reading content from memory...

CVE-2024-23531

CVE-2024-23531 affects Ivanti Avalanche WLInfoRailService prior to 6.4.3. The issue is an integer overflow in WLInfoRailService that can allow an unauthenticated, remote attacker to cause a denial of service; in rare conditions it may also read memory contents. Public disclosures and third-party ...

CVE-2024-23531

An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial of service attacks. In certain rare conditions this could also lead to reading content from memory...

CVE-2024-23531

An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial of service attacks. In certain rare conditions this could also lead to reading content from memory...

CVE-2023-3675

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Secomea GateManager Web GUI allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051...

CVE-2023-3675 Insufficient input validation when downloading certain file types.

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Secomea GateManager Web GUI allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051...

CVE-2023-3675

CVE-2023-3675 affects Secomea GateManager (Web GUI). The issue is a path traversal vulnerability in GateManager that allows reading data from system resources. Affected versions are 11.0.623074018 up to, but not including, 11.0.623373051. The Root Cause and Verified Impact are described as improp...

PT-2024-12585

Name of the Vulnerable Software and Affected Versions Secomea GateManager versions 11.0.623074018 through 11.0.623373051 Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', in the Web GUI of Secomea GateManager. This...

CVE-2023-3675: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Secomea GateManager Web GUI allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051...

DEBIAN-CVE-2024-21096

Vulnerability in the MySQL Server product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to...

ALPINE-CVE-2024-21096

Vulnerability in the MySQL Server product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to...

CVE-2024-21023

Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite component: LOV. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

UBUNTU-CVE-2024-21000

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromi...

CVE-2024-1594 Local File Read via Path Traversal in mlflow/mlflow

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component in the artifact location URI to read arbitrary files on the...