154 matches found
CVE-2022-31535
The freefood89/Fishtank repository through 2015-06-24 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
LoLLMs Web UI 代码问题漏洞
LoLLMs Web UI is a web user interface for large languages and multimodal systems by Saifeddine ALOUI Individual Developer. A code issue vulnerability exists in LoLLMs Web UI version v12, which stems from the Send file to AL feature that allows uploading of dangerous files, which could lead to...
Apache Tomcat 7.0.0 < 7.0.77
The version of Tomcat installed on the remote host is prior to 7.0.77. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.77security-7 advisory. - A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12,...
CVE-2023-32164
D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exist...
PT-2024-19407 · Unknown · Whoogle Search
Name of the Vulnerable Software and Affected Versions: Whoogle Search versions 0.8.3 and prior Description: Whoogle Search is a self-hosted metasearch engine. The element method in app/routes.py does not validate the user-controlled src type and element url variables and passes them to the send...
CVE-2021-26504
Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js...
node-red-contrib-huemagic path traversal vulnerability
node-red-contrib-huemagic is a solution for Foddy individual developers. A security vulnerability exists in Foddy node-red-contrib-huemagic version 3.0.0, which stems from a directory traversal vulnerability. An attacker can exploit this vulnerability to obtain sensitive information by sending a...
SUSE CVE-2016-8745
A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn...
SUSE CVE-2017-5647
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. Thi...
SUSE CVE-2017-5651
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in t...
audio_aligner_app path traversal vulnerability
audioalignerapp is a kaldi-based text alignment Web application open sourced by LongmaoTeamTf. audioalignerapp 2020-01-10 and earlier versions contain a path traversal vulnerability that stems from Flask's sendfile function failing to properly filter resources or file path, which can be exploited...
equanimity path traversal vulnerability
equanimity is a world-building game by A. F. Dudley, a solo developer with an emphasis on squad-based turn-based combat and balance. equanimity 2014-04-23 and earlier versions are vulnerable to a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filte...
CVE-2022-31587
The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31586
The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31579
The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31576
The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31587
The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31576
The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...