SUSE CVE-2018-16088

A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no user input via a crafted HTML page...

SUSE CVE-2021-41281

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. T...

SUSE CVE-2022-31255

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files...

SUSE-SU-2023:0323-1 Security update for python-swift3

This update for python-swift3 fixes the following issues: - CVE-2022-47950: Fixed an issue that could allow a remote attacker to disclose local file contents via a crafted XML file bsc1207035...

CVE-2023-20073

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...

Remote file inclusion

The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users. Internal service access controls, as applicable, remain in effect...

Remote File Inclusion

cakephp/cakephp is vulnerable to Remote File Inclusion. The vulnerability is due to the getViewFileName function in View.php which allows an attacker to execute arbitrary scripts outside the view path by manipulating view template filenames...

CVE-2022-29844

A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker...

The vulnerability of Advantech R-SeeNet router microprogramming software arises due to an incorrect limitation on the path name to the restricted access catalog. This allows a hacker to delete any arbitrary files.

The vulnerability of Advantech R-SeeNet router microprogramming software exists due to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

GHSA-P76F-WR22-4RV6 CakePHP vulnerable to Remote File Inclusion through View template name manipulation

CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation...

CakePHP vulnerable to Remote File Inclusion through View template name manipulation

CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation...

CVE-2009-10002 dpup fittr-flickr EXIF Preview easy-exif.js cross site scripting

A vulnerability, which was classified as problematic, has been found in dpup fittr-flickr. This issue affects some unknown processing of the file fittr-flickr/features/easy-exif.js of the component EXIF Preview Handler. The manipulation leads to cross site scripting. The attack may be initiated...

CVE-2022-43514

A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4, TeleControl Server Basic V3 All versions V3.1.2. The affected component does not correctly validate the root path on folder related operations, allowing to...

CVE-2014-125044

A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of the argument p leads to file inclusion. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this...

CVE-2022-43932

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in CGI component in Synology Router Manager SRM before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2022-43932

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in CGI component in Synology Router Manager SRM before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to read arbitrary files via unspecified vectors...

The vulnerability of the packet handler in the centralized video surveillance equipment management system of Dahua DSS Professional and DSS Express, as well as the DHI-DSS4004-S2/DHI-DSS7016D-S2/DHI-DSS7016DR-S2 video surveillance management servers, allows a intruder to load arbitrary files into the system.

The vulnerability of the packet handler in the centralized video surveillance equipment management system of Dahua DSS Professional and DSS Express, as well as the DHI-DSS4004-S2/DHI-DSS7016D-S2/DHI-DSS7016DR-S2 video surveillance management servers, is related to the ability to load unlimited...

PT-2023-14405 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager versions prior to 1.2.5-8227-6 Synology Router Manager versions prior to 1.3.1-9346-3 Description: The issue is related to improper neutralization of special elements in output used by a downstream component, also know...

Remote file inclusion

A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.type.php endpoint, external users are capable of accessing files on the server...

Hughes Satellite Router Remote File Inclusion Cross Frame Scripting Vulnerability

Hughes Satellite Router contains a cross-frame scripting via remote file inclusion vulnerability that may potentially be exploited by malicious users to compromise an affected system. This vulnerability may allow an unauthenticated malicious user to misuse frames, include JS/HTML code and steal...