The vulnerability of the MacOS operating system, related to insufficient validation of input data, allows a hacker to gain access to and modify system files.

The vulnerability of the MacOS operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to and modify system files...

CVE-2025-1982

CVE-2025-1982 is a Local File Inclusion vulnerability in Ready’s attachment upload panel. The Red Hat CVE-2025-1982 entry confirms a low-privilege user can exploit a file:// link to read local system files, indicating a confidentiality impact. Connected RH entries also describe a related CVE-2025...

SAP Capital Yield Tax Management Directory Traversal Vulnerability

SAP Capital Yield Tax Management is a tool for capital gains tax calculation, reporting and compliance management from SAP. A directory traversal vulnerability exists in SAP Capital Yield Tax Management, which can be exploited by an attacker to submit a special request to view the contents of...

CVE-2024-47769

IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...

CVE-2024-57252

OtCMS =V7.46 is vulnerable to Server-Side Request Forgery SSRF in /admin/read.php, which can Read system files arbitrarily...

mySCADA myPRO 安全漏洞

mySCADA myPRO is a professional HMI/SCADA system designed primarily for the visualization and control of industrial processes. A directory traversal vulnerability exists in mySCADA myPRO Manager, which can be exploited by an attacker to submit a special request to view the contents of a system fi...

CVE-2022-25777 Server-Side Request Forgery in Asset section

Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery SSRF vulnerability...

CVE-2024-8752 WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability

The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system...

TopQuadrant TopBraid EDG Insecure External Password Storage and XXE Vulnerabilities

RISK EVALUATION TopQuadrant TopBraid EDG stores credentials for external services insecurely and processes untrusted XML entities. An authenticated attacker could obtain credentials for remote services, read local files, or access URLs. 2. RECOMMENDED PRACTICES Upgrade to TopQuadrant TopBraid...

ZkTeco OEM 路径遍历漏洞

ZkTeco OEM is an intelligent system from the Chinese company ZkTeco. ZkTeco OEM suffers from a path traversal vulnerability that originates from allowing an attacker to access any file on the system. The following products and versions are affected: ZkTeco ProFace X, Smartec ST-FR043, Smartec...

Progress Software Telerik Report Server 安全漏洞

Progress Software Telerik Report Server is an enterprise-level report management and distribution solution from Progress Software. A security vulnerability exists in Progress Software Telerik Report Server version 2024 Q1 and prior versions. An attacker exploited the vulnerability to read system...

Path Traversal

mapshaper is vulnerable to Path Traversal. The vulnerability is caused due to not sanitizing the request URL path when a request is received. This allows an attacker to read any file in the system with privilege of the user running the mapshaper-gui...

CVE-2023-4552 Java Database Connectivity (JDBC) URL Manipulation

Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including access to its local file system. This...

CVE-2023-43044 IBM License Metric Tool directory traversal

IBM License Metric Tool 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 266893...

CVE-2023-41040 GitPython blind local file inclusion

GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the .git directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the .git...

CVE-2022-47617

Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrypt system files using the hard-coded keys for file access, modification, and cause service disruption...

PT-2023-20956 · Shanling · Shanling M5S +2

Name of the Vulnerable Software and Affected Versions: Shanling M5S Portable Music Player with Shanling MTouch OS version 4.3 Shanling M2X Portable Music Player with Shanling MTouch OS version 3.3 Description: A vulnerability in the Wi-Fi file transfer module allows attackers to arbitrarily read,...

CVE-2023-27105

A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player with Shanling MTouch OS v3.3 allows attackers to arbitrarily read, delete, or modify any critical system files via directory traversal...

CVE-2023-26255

CVE-2023-26255 affects the STAGIL Navigation for Jira Menu & Themes plugin for Jira (before 2.0.52). Multiple sources confirm an unauthenticated path traversal/local file inclusion via the snjCustomDesignConfig endpoint when the fileName parameter is modified, enabling an attacker to read server ...

VulnCheck KEV: CVE-2020-3153

Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and...