711 matches found
Path Traversal
getkirby/cms is vulnerable to Path Traversal. The vulnerability is due to lack of validation in the router to ensure that requested files are within the document root, allowing access checks on files outside the intended directory when using PHPβs built-in server...
SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root
SonicWall has released patches to address three security flaws affecting SMA 100 Secure Mobile Access SMA appliances that could be fashioned to result in remote code execution. The vulnerabilities are listed below - CVE-2025-32819 CVSS score: 8.8 - A vulnerability in SMA100 allows a remote...
PT-2025-19376
Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 2.0.0 and earlier Description An XML External Entity XXE vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed...
OpenPanel 0.3.4 - Directory Traversal
Exploit Title: OpenPanel 0.3.4 - Directory Traversal Date: Dec 05, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macOS CVE : CVE-2024-53537 Compress Function POS...
Path Traversal
YesWiki is vulnerable to Path Traversal. The vulnerability is due to insufficient input validation due to improper sanitization of the squelette parameter, allowing unauthorized file read access on the server...
CVE-2025-32373
CVE-2025-32373 affects DNN (DotNetNuke) in the Microsoft ecosystem. In limited configurations, registered users may craft a request to enumerate or access portal files they should not have access to. The issue is fixed in version 9.13.8. Remediation: upgrade to 9.13.8 or newer to resolve the vuln...
PT-2025-15696 Β· Ibm Β· Ibm Security Guardium
Name of the Vulnerable Software and Affected Versions: IBM Security Guardium versions 11.4 through 12.1 Description: The issue allows a privileged user to read any file on the system due to incorrect privilege assignment. Recommendations: For versions 11.4 through 12.1, update to a version that...
CVE-2024-41792
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices contains a path traversal vulnerability. This could allow an unauthenticated attacker it to access arbitrary files on the device with root privileges...
Unauthorized File Access
awssamcli is vulnerable to Unauthorized File Access. The vulnerability is due to improper handling of symlinks during the Docker build process, allowing access to privileged host files via elevated permissions...
Unauthorized File Access
awssamcli is vulnerable to Unauthorized File Access. The vulnerability is due to insecure symlink resolution during the build process, which causes the contents of symlinks to be copied into the local workspace cache as regular files, allows an attacker to access restricted files...
π Kemal Framework 1.6.0 Path Traversal
Kemal Framework version 1.6.0 suffers from a path traversal vulnerability. Exploit Title: Kemal Framework 1.6.0 - Path Traversal Discovered by: Ahmet Γmit BAYRAM Discovered Date: 04.04.2025 Vendor Homepage: https://github.com/kemalcr Software Link:...
CVE-2025-24233
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to read or write to protected files...
CVE-2025-24233
CVE-2025-24233 describes a permissions issue addressed by upgrades to macOS Ventura 13.7.5, macOS Sequoia 15.4, and macOS Sonoma 14.7.5. The issue could let a malicious app read or write to protected files. Remediation is to apply the fixed OS updates listed; no exploitation details are provided ...
CVE-2025-27716
CVE-2025-27716 affects HGW-BL1500HM (Ver 002.002.003 and earlier) and is a path traversal vulnerability in the USB storage file-sharing function. The issue arises in the file/folder listing path handling, allowing a crafted HTTP request from a LAN-connected device to obtain and/or alter product f...
CVE-2024-12905
CVE-2024-12905 affects the tar-fs package (index.js) and enables path traversal and related file writes/overwrites during extraction of crafted tar archives. Affected ranges: tar-fs < 1.16.4, < 2.1.2, and
CVE-2024-12905
An Improper Link Resolution Before File Access "Link Following" and Improper Limitation of a Pathname to a Restricted Directory "Path Traversal". This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intend...
PT-2025-13380
Name of the Vulnerable Software and Affected Versions tar-fs versions 0.0.0 through 1.16.3 tar-fs versions 2.0.0 through 2.1.1 tar-fs versions 3.0.0 through 3.0.7 Description This issue is related to an Improper Link Resolution Before File Access "Link Following" and Improper Limitation of a...
Incorrect Authorization
Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Incorrect Authorization due to missing checks in transformMiddleware which ignore certain query parameters. An attacker can access unauthorized files by including a ?raw?? ...
CVE-2024-10940
A flaw was found in Langchain Core. This vulnerability allows unauthorized users to read arbitrary files from the host file system by creating ImagePromptTemplate or ChatPromptTemplate with input variables that can access any user-specified path on the server. Mitigation Mitigation for this issue...
CVE-2025-26138
Systemic Risk Value =2.8.0 is vulnerable to improper access control in /RiskValue/GroupingEntities/Controls/GetFile.aspx?ID=. Uploaded files are accessible via a predictable numerical ID parameter, allowing unauthorized users to increment or decrement the ID to access and download files they do n...