CVE-2024-7340 W&B Weave server remote arbitrary file leak and privilege escalation

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin...

CVE-2024-7340 W&B Weave server remote arbitrary file leak and privilege escalation

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin...

AccPack Buzz 1.0 Arbitrary File Upload

============================================================================================================================================= | Title : AccPack Buzz v1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64...

Weave 安全漏洞

Weave is a toolkit for developing generative AI applications open-sourced by Weights & Biases. Weave has a security vulnerability that stems from an API that allows a remote user to fetch files from a specific directory, leading to remote traversal and disclosure of arbitrary files...

The vulnerability in the upload.php script of the UploadFile class in the Ruijie EG-2000SE software library allows attackers to upload arbitrary files.

The vulnerability of the upload.php script in the UploadFile class of the Ruijie EG-2000SE gateway software relates to the ability to upload files of a dangerous type without restrictions. Exploiting this vulnerability allows an attacker to remotely upload any type of files...

Exploit for CVE-2000-0114

This is a collection of vulnerability templates for the Nuclei vulnerability scanner. The templates are organized by CVE ID and include information such as the vulnerability name, description, severity, and remediation steps. The templates also include HTTP requests and matchers to identify the...

SchoolPlus 1.0 Shell Upload

============================================================================================================================================= | Title : SchoolPlus v1.0 Remote File Upload Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64...

PT-2024-29470 · Severalnines · Severalnines Clustercontrol

Name of the Vulnerable Software and Affected Versions: Severalnines Cluster Control versions 1.9.8 through 1.9.8-9777 Severalnines Cluster Control versions 2.0.0 through 2.0.0-9778 Severalnines Cluster Control versions 2.1.0 through 2.1.0-9779 Description: A Directory Traversal issue allows a...

Apache Drill XML External Entity Injection Vulnerability

Apache Drill is an open source software framework from the American company Apache Apache. Apache Drill 1.19.0 and earlier versions suffer from an XML external entity injection vulnerability that can be exploited by an attacker to read any file on a remote file system or execute commands through ...

GHSA-V62G-JWJ9-RFVX XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue...

CVE-2023-48362 Apache Drill: XXE Vulnerability in XML Format Reader

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue...

CVE-2023-48362

CVE-2023-48362 describes a XXE vulnerability in the XML Format Plugin of Apache Drill . The issue affects Drill 1.19.0 and later, enabling an attacker to read arbitrary files on a remote file system or execute commands through a crafted XML file. The documented remediation is to upgrade to Apache...

Apache Drill 代码问题漏洞

Apache Drill is an open source software framework from the American company Apache Apache. Apache Drill 1.19.0 and earlier versions suffer from an XML external entity injection vulnerability that can be exploited by an attacker to read any file on a remote file system or execute commands through ...

The vulnerability of the SCADA system MasterSCADA 4D, related to incorrect restrictions on the path to the restricted access catalog, allows a intruder to read arbitrary files.

The vulnerability of the SCADA system MasterSCADA 4D is related to an incorrect restriction on the path to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to read arbitrary files remotely...

CVE-2024-6937

A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curlexec of the file /admin/forms/optionlists/edit.php of the component Import Option List. The manipulation of the argument url leads to file inclusion. It is possible to...

CVE-2024-6937

Form Tools 3.1.1 is affected in the Import Option List component, specifically the curl_exec function in /admin/forms/option_lists/edit.php. The vulnerability arises from manipulation of the url argument, causing file inclusion and enabling a remote attack. Public disclosure is noted. Remediation...

IoT-vulnerable

It is an IoT device vulnerability testing framework. The target...

VulnCheck KEV: CVE-2024-38735

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through = 5.9.5...

The vulnerability of the Splunk Web platform for operational analysis in Splunk Enterprise allows a hacker to read arbitrary files.

The vulnerability of the Splunk Web platform for operational analysis in Splunk Enterprise relates to an incorrect restriction on the path to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to read arbitrary files remotely...

The vulnerability of the web server used by the monitoring and network traffic analysis software in SINEC Traffic Analyzer allows a perpetrator to gain access to modify arbitrary files.

The vulnerability of the web server used by the monitoring and network traffic analysis software in SINEC Traffic Analyzer is related to the use of dangerous HTTP methods. Exploiting this vulnerability can allow a malicious actor to remotely access and modify arbitrary files...