Arbitrary File Read Vulnerability in Cyber-Sign's NetSign Digital Signature System

Ltd. is the earliest professional vendor engaged in the research, development and application of PKI technology in China. There is an arbitrary file reading vulnerability in the NetSign digital signature system, which can be exploited by an attacker to read server files...

Wipro Holmes Orchestrator 20.4.1 Report Disclosure

Exploit Title: Wipro Holmes Orchestrator 20.4.1 Unauthenticated Excel Report Download Date: 09/08/2021 Exploit Author: Rizal Muhammed @ub3rsick Vendor Homepage: https://www.wipro.com/holmes/ Version: 20.4.1 Tested on: Windows 10 x64 CVE : CVE-2021-38147 In the Wipro Holmes Orchestrator 20.4.1...

PT-2022-11303 · Alt Linux · Alt Linux

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to insufficient escaping of the LaTeX preamble, which allows site administrators to read files available to the HTTP server system...

CVE-2021-40745

Adobe Campaign version 21.2.1 and earlier is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server...

CVE-2021-40745

Adobe Campaign version 21.2.1 and earlier is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server...

Path traversal

Adobe Campaign version 21.2.1 and earlier is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server...

PT-2021-5511

Name of the Vulnerable Software and Affected Versions Adobe Campaign versions 21.2.1 and earlier Description The issue is related to a Path Traversal vulnerability that could allow an unauthenticated attacker to read arbitrary server files by leveraging an exposed XML file. This can lead to the...

PT-2021-9846

Name of the Vulnerable Software and Affected Versions FortiClientEMS versions 6.4.1 and below FortiClientEMS versions 6.2.8 and below Description A path traversal issue in FortiClientEMS may allow an authenticated attacker to inject directory traversal character sequences, enabling them to add or...

FortiClientEMS - Directory Traversal vulnerability

A path traversal vulnerability CWE-22 in FortiClientEMS may allow an authenticated attacker to inject directory traversal character sequences to add/delete the files of the server via the name parameter of Deployment Packages...

CVE-2021-39433

A local file inclusion LFI vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user...

Biqs It Biqs-drive security vulnerability

Biqs It Biqs-drive is an online driving school software from the Belgian company Biqs It. BIQS IT Biqs-drive v1.83 and below is vulnerable to a local file inclusion vulnerability, which could be exploited by attackers to read arbitrary files from the server using the privileges of the configured...

CVE-2021-40356

A vulnerability has been identified in Teamcenter V12.4 All versions V12.4.0.8, Teamcenter V13.0 All versions V13.0.0.7, Teamcenter V13.1 All versions V13.1.0.5, Teamcenter V13.2 All versions 13.2.0.2. The application contains a XML External Entity Injection XXE vulnerability. This could allow an...

CVE-2021-33555

In PEPPERL+FUCHS WirelessHART-Gateway = 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server...

CVE-2021-24549

The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server...

CVE-2021-24549

The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server...

Code injection

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server...

XML Entity Injection Vulnerability in jeewms

jeewms is led by Linglu Valley Technology open source project , JAVA-based warehouse management system support for self- and third-party , including PDA side and WEB side . jeewms there is an XML entity injection vulnerability , an attacker can use the vulnerability to read the server file...

Echo ShareCare security vulnerability

ShareCare is a clinical and financial software system from Echo Group. A security vulnerability exists in Echo ShareCare version 8.15.5 that stems from the TextReader function in General/TextReader/TextReader.cfm being susceptible to a local file inclusion vulnerability when processing remote inp...

Files or Directories Accessible to External Parties in ether/logs

Impact A vulnerability was found that allowed authenticated admin users to access any file on the server. Patches The vulnerability has been fixed in 3.0.4. Workarounds We recommend disabling the plugin if untrustworthy sources have admin access. For more information If you have any questions or...

CVE-2021-32752

Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any file on the server. The vulnerability has been fixed in version 3.0.4. As a workaround, one may...