1373 matches found
CVE-2024-0549
mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input...
CVE-2024-0549 Relative Path Traversal in mintplex-labs/anything-llm
mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input...
CVE-2024-0549
The CVE-2024-0549 entry concerns mintplex-labs/anything-llm and describes a relative path traversal in deletion requests. The root cause is insufficient input validation/normalization when handling file and folder deletion, allowing an authenticated default-role attacker to delete files (includin...
CVE-2024-0549: Relative Path Traversal
mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input...
OESA-2024-1399 rubygem-tzinfo security update
TZInfo provides daylight savings aware transformations between times in different time zones. Security Fixes: TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when use...
CVE-2024-32005: Relative Path Traversal
NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the /nicegui/version/resources/key/path:path route. As a result any file on the backend filesystem which the web server has access to can be...
CVE-2024-0335: Relative Path Traversal
ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products e.g., S+ Operations, S+ Engineering and S+ Analyst This issue affects Symphony Plus S+ Operations: from 3..0;0 through 3.3 SP1 RU4, from 2.1;0...
CVE-2024-27770
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal...
CVE-2024-27770
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal...
CVE-2024-27770 Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-23: Relative Path Traversal
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal...
CVE-2024-27770
Unitronics Unistream Unilogic (versions prior to 1.35.227) is affected by CWE-23 Relative Path Traversal in the web-facing component. An attacker could access files outside the web root directory, exposing sensitive data. Remediation: upgrade to version 1.35.227 or later; as a temporary measure, ...
CVE-2024-27770: Relative Path Traversal
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal...
Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability
Vulnerability Details Affected Vendor: Artica Affected Product: Artica Proxy Affected Version: 4.40 and 4.50 Platform: Debian 10 LTS CWE Classification: CWE-23: Relative Path Traversal CVE ID: CVE-2024-2053 2. Vulnerability Description The Artica Proxy administrative web application attempts to...
CVE-2024-2053: Relative Path Traversal
The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to...
CVE-2024-0550: Relative Path Traversal
A user who is privileged already manager or admin can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack...
CVE-2023-42791
CVE-2023-42791 describes a relative path traversal in Fortinet FortiManager that allows an attacker to execute unauthorized code or commands via crafted HTTP requests. The vulnerability affects FortiManager versions: 7.4.0, 7.2.0–7.2.3, 7.0.0–7.0.8, 6.4.0–6.4.12, and 6.2.0–6.2.11. The connected R...
CVE-2023-42791: Relative Path Traversal
A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests...
CVE-2024-24942: Relative Path Traversal
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives...