B&R Industrial Automation B&R APROL 安全漏洞

B&R Industrial Automation B&R APROL is a process control system from B&R Industrial Automation, Austria. A security vulnerability exists in B&R Industrial Automation B&R APROL versions prior to 4.4-005P, which originates from an external control of file names or paths in the APROL Web Portal, and...

Microhard 3G/4G Cellular Ethernet and Serial Gateway External Control of File Name or Path (ZSL-2018-5484)

The system backup configuration file 'IPn4G.config' in '/' directory or its respective name based on the model name including the similar files in '/www/cgi-bin/system.conf', '/tmp' and the cli.conf in '/etc/mcli/' can be downloaded by an authenticated attacker in certain circumstances. This will...

CVE-2024-8537

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling t...

CVE-2024-10835

CVE-2024-10835 affects eosphoros-ai/db-gpt v0.6.0. The web API endpoint POST /api/v1/editor/sql/run allows executing arbitrary SQL without access control, enabling Arbitrary File Write via DuckDB SQL and potentially Remote Code Execution (RCE). Affected component: DB-GPT web API handler for edito...

CODESYS Control 路径遍历漏洞

CODESYS Control is a suite of industrial control program programming software from CODESYS, Germany. CODESYS Control suffers from a path traversal vulnerability that stems from insufficient path validation, which could allow a low-privileged attacker to gain full file system access...

CVE-2024-54449

The CVE-2024-54449 entry describes a flaw in LogicalDOC’s document API where two endpoints allow an authenticated user (with read/write on an existing document) to write arbitrary files to the server’s filesystem, enabling potential remote code execution. Affected component: the document-manageme...

Xerox Desktop Print Experience application 安全漏洞

The Xerox Desktop Print Experience application is a scanning and printing application from a desktop or laptop computer from Xerox USA. It is used to enable convenient scanning and printing operations without complicated settings. A security vulnerability exists in the Xerox Desktop Print...

PT-2025-10780 · Fortinet · Fortisandbox

Name of the Vulnerable Software and Affected Versions: FortiSandbox versions prior to 4.4.5 Description: The issue is related to improper neutralization of special elements used in an OS Command, allowing a privileged attacker to execute unauthorized commands via crafted requests. Recommendations...

Esri ArcGIS Server Catalog Traversal Vulnerability

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A directory traversal vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by a remote authenticated attacker to access files outside the file syst...

ABB Cylon Aspect 3.08.01 (caldavUpload.php) Funkalicious Exploit

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description Yo, check it - the ABB BMS/BAS system's got a slick little weakness i...

Linux Distros Unpatched Vulnerability : CVE-2017-5454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker...

Linux Distros Unpatched Vulnerability : CVE-2019-3835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this...

CVE-2024-51958 Directory traversal vulnerability in the admin api for service thumbnails

There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or...

webkitgtk: A maliciously crafted webpage may be able to fingerprint the user

A flaw was found in WebKitGTK. A maliciously crafted web page may be able to fingerprint the user due to improper access restrictions to the file system...

webkitgtk: A maliciously crafted webpage may be able to fingerprint the user

A flaw was found in WebKitGTK. A maliciously crafted web page may be able to fingerprint the user due to improper access restrictions to the file system...

Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro

Summary If untrusted user input is used to dynamically create a PebbleTemplate with the method PebbleEnginegetLiteralTemplate, then an attacker can include arbitrary local files from the file system into the generated template, leaking potentially sensitive information into the output of...

CVE-2025-26326

A vulnerability was identified in the NVDA Remote version 2.6.4 and Tele NVDA Remote version 2025.3.3 remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered ...

CVE-2025-27098 Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...

CVE-2025-27098 Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...

CVE-2024-5706 Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. CWE-99 Hitachi Vantara Pentaho Data Integration & Analytics versions before...