2832 matches found
CVE-2024-40617
Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 M2M-GW for FENICS. If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result,...
SolarWinds Serv-U Path Traversal Vulnerability
SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine...
PT-2024-5723 · Fujitsu · Fujitsu Network Edgiot Gw1500
Name of the Vulnerable Software and Affected Versions: FUJITSU Network Edgiot GW1500 M2M-GW for FENICS versions not specified Description: The issue is related to a path traversal vulnerability, which may allow a remote attacker with User Class privilege to access restricted files containing...
Arbitrary File Access
OpenStack Cinder, Glance, and Nova are vulnerable to Arbitrary File Access. The vulnerability is due to a flaw in handling custom QCOW2 external data, where a crafted QCOW2 image can reference a specific data file path. The vulnerability allows an authenticated user to retrieve unauthorized copie...
ServiceNow Security Vulnerability
ServiceNow is a cloud computing platform from US-based ServiceNow, Inc. to help companies manage digital workflows for business operations. A security vulnerability exists in ServiceNow. An attacker exploiting the vulnerability could access sensitive files on the web application server...
The vulnerability of SAP Document Builder in creating and managing documents allows for unlimited uploading of sensitive files, enabling an attacker to gain access to read, modify, or delete data.
The vulnerability of SAP Document Builder for document creation and management lies in its ability to allow unlimited uploading of sensitive files. Exploiting this vulnerability could enable a malicious actor to gain read, modify, or delete access to data...
GHSA-MWXM-35F8-6VG2 Vanna vulnerable to SQL Injection
vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as pgreadfile. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like /etc/passwd, by exploiting the exposed SQL...
Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce
🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the...
PT-2024-35727 · Devika · Devika
Name of the Vulnerable Software and Affected Versions: stitutionai/devika version latest Description: A local file read issue exists due to improper handling of the snapshot path parameter in the "/api/get-browser-snapshot" endpoint. An attacker can exploit this by crafting a request with a...
CVE-2023-49110 XML External Entity Injection in Kiuwan SAST
When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application either on-premises or cloud/SaaS solution, the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side processing of these XML...
Improper Access Control
mediawiki/core is vulnerable to Improper Access Control. The vulnerability is due to the absence of a .htaccess file which is required to protect some directories from web access, potentially allowing attackers to access sensitive files and directories that shouldn't be web accessible...
PT-2024-13676 · Unknown · Kiuwan Local Analyzer +1
Name of the Vulnerable Software and Affected Versions: Kiuwan SAST version master.1808.p685.q13371 Description: The issue arises when the Kiuwan Local Analyzer uploads scan results to the Kiuwan SAST web application, which processes XML files containing external entities. This leads to an XML...
CVE-2024-34112 ColdFusion CFDOCUMENT file retrieval / access control bypass
ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could exploit this vulnerability to gain unauthorized access to sensitive files or data. Exploitation of this issue does not requir...
CVE-2024-4576
The component listed above contains a vulnerability that allows an attacker to traverse directories and access sensitive files, leading to unauthorized disclosure of system configuration and potentially sensitive information...
CVE-2024-4576 TIBCO EBX File Inclusion Vulnerability
The component listed above contains a vulnerability that allows an attacker to traverse directories and access sensitive files, leading to unauthorized disclosure of system configuration and potentially sensitive information...
CVE-2024-5211
A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the normalizePath function, intended to defend against path traversal attacks. This vulnerability enables the manager to read, delete, or overwrite the 'anythingllm.db' database file and other files stored in...
File Disclosure
vrana/adminer is vulnerable to File Disclosure. This vulnerability is due to insufficient input validation, allowing unauthorized access to sensitive files within the application's directory...
CVE-2024-33606
An attacker could retrieve sensitive files medical images as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User interaction is required to exploit this vulnerability...
CVE-2024-33606 MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL Scheme
An attacker could retrieve sensitive files medical images as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User interaction is required to exploit this vulnerability...
CVE-2024-33606 MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL Scheme
An attacker could retrieve sensitive files medical images as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User interaction is required to exploit this vulnerability...