PT-2023-18859 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions 4.0.0.0 through 4.0.2.2 Description: The issue allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server. This is due to a Path Traversal vulnerability...

Arbitrary File Read

OpenRefine is vulnerable to Arbitrary File Read. The vulnerability due to improper jdbc url sanitization, which allows an attacker to set the allowLoadLocalInfile value to true by passing it through the databaseName parameter. This can be exploited to read sensitive internal server files...

CVE-2023-3814

The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server...

WordPress plugin Orders Tracking for WooCommerce path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability in the...

SHIRASAGI Path Traversal Vulnerability

SHIRASAGI is a content management system CMS for the Japanese Shirasagi project. A security vulnerability exists in SHIRASAGI versions prior to v1.18.0. An attacker could exploit this vulnerability to execute arbitrary code by changing or creating arbitrary files on the server...

ZOHO ManageEngine ADManager Plus has a path traversal vulnerability

ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and helpdesk technicians with day-to-day administrative tasks, such as batch management of user...

CVE-2023-25914 Authneticated Path Traversal in Danfoss AK-SM800A

Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise...

PT-2023-20359 · Danfoss · Ak-Sm800A +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface, potentially leading to a full system compromis...

Danfoss AK-SM800A path traversal vulnerability

Danfoss AK-SM800A is a system manager from Danfoss, Denmark. Provides secure system control and monitoring A path traversal vulnerability exists in Danfoss AK-SM800A 3.3 and earlier versions, which stems from an improper restriction, and can be exploited by an attacker to retrieve and read system...

Apache Airflow input validation vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow Spark Provider...

Apache Airflow Input Validation Error Vulnerability (CNVD-2023-67067)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Drill Provider...

Broadcom RAID Controller Access Control Error Vulnerability

The Broadcom RAID Controller is a series of RAID controllers from Broadcom Corporation. A security vulnerability exists in the Broadcom RAID Controller that originates from allowing a web server to provide private server files to an unauthenticated attacker...

CVE-2023-33365

A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files from the server's web server...

PT-2023-26572 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: Pimcore versions prior to 10.6.7 Description: A path traversal vulnerability exists in the AssetController::importServerFilesAction, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore log parameter. Th...

copyparty vulnerable to reflected cross-site scripting via k304 parameter

Summary The application contains a reflected cross-site scripting via URL-parameter ?k304=... and ?setck=... Details A reflected cross-site scripting XSS vulnerability exists in the web interface of the application that could allow an attacker to execute malicious javascript code by tricking user...

CVE-2023-2268

Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users...

CVE-2023-2268

Plane v0.7.1 exposes a high‑confidentiality impact flaw: an unauthenticated attacker can view all stored server files of all users. Affected component is Plane software; root cause details are not explicitly stated beyond the access to stored files. NVD records CVSS‑3.1 base: 7.5 (AV:N/AC:L/PR:N/...

CVE-2023-2268 Plane v0.7.1 - Unauthorized access to files

Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users...

Plane Information Leakage Vulnerability

Plane is an open source, self-hosted project planning tool from Plane Open Source. A security vulnerability exists in Plane version 0.7.1 that stems from allowing an unauthenticated attacker to view all server files stored by all users...

PT-2023-18624 · Plane · Plane

Name of the Vulnerable Software and Affected Versions: Plane version 0.7.1 Description: The issue allows an unauthenticated attacker to view all stored server files of all users. Recommendations: For Plane version 0.7.1, update to a version that contains a fix for this issue, as the current versi...