680 matches found
PT-2023-29956 · Unknown · Sd-Webui-Infinite-Image-Browsing
Name of the Vulnerable Software and Affected Versions: sd-webui-infinite-image-browsing extension versions before 977815a Description: The issue allows remote attackers to read any local file via the "/file?path=" endpoint in the URL, as demonstrated by reading /proc/self/environ to discover...
CVE-2023-46315
The CVE-2023-46315 issue affects the sd-webui-infinite-image-browsing extension for stable-diffusion-webui up to version 977815a. If Gradio authentication is enabled without a secret key, an unauthenticated remote attacker can read local files via the /file?path= endpoint, with demonstrations inc...
CVE-2023-44962
File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component...
CVE-2022-47892
All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file config.cgi containing sensitive information, like credentials...
CVE-2023-41740
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in cgi component in Synology Router Manager SRM before 1.3.1-9346-6 allows remote attackers to read specific files via unspecified vectors...
PT-2023-8890
Name of the Vulnerable Software and Affected Versions Ray affected versions not specified Description The issue is related to incorrect restriction of a directory path with limited access in the Ray framework for scaling AI and Python applications. This can be exploited by a remote attacker to re...
CVE-2021-4324
Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files via a malicious file. Chromium security severity: Medium...
CVE-2023-2880
Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi v1.3.3 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesystem of the FDS001 device...
CVE-2023-33277
The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 allows a remote attacker to read sensitive files via directory-traversal sequences in the URL...
Jeecg P3 Biz Chat allows remote attackers to read arbitrary files
Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters...
CVE-2023-1864
FANUC ROBOGUIDE-HandlingPRO Versions 9 Rev.ZD and prior is vulnerable to a path traversal, which could allow an attacker to remotely read files on the system running the affected software...
CVE-2023-1864
FANUC ROBOGUIDE-HandlingPRO, Versions 9 Rev.ZD and prior, is affected by CVE-2023-1864 (path traversal). The root cause is improper limitation of a pathname to a restricted directory, enabling a remote attacker to read files on the system running the software. According to published advisories, t...
CVE-2023-33510
Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters...
CVE-2023-32235
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js...
SUSE CVE-2006-2758
Directory traversal vulnerability in jetty 6.0.x jetty6 beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c encoded ../ in the URL. NOTE: this might be the same issue as CVE-2005-3747...
CVE-2022-36982
This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandle...
Design/Logic Flaw
This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandle...
CVE-2022-36982
CVE-2022-36982 affects Ivanti Avalanche 6.3.3.101. The flaw is in the AgentTaskHandler and stems from inadequate validation of a user-supplied path before file operations, enabling a path-traversal-like disclosure of arbitrary files and stored session cookies. Authentication is required to exploi...
PT-2023-2050 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.4-p2 and earlier Adobe Commerce versions 2.4.5-p1 and earlier Description: The issue is related to errors in processing XML requests, which could allow a remote attacker to gain unauthorized access to protected...