16891 matches found
PT-2024-32016 · Unknown · Simple-Spellchecker
Name of the Vulnerable Software and Affected Versions: Simple-Spellchecker version 1.0.2 Description: An issue in the readFileSync function allows attackers to read arbitrary files via a directory traversal. This issue affects the readFileSync function, enabling attackers to read any file...
CVE-2024-8353 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'givetitle' and 'cardaddress'. This makes it possible for unauthenticate...
EUVD-2024-48637
The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...
Logsign Unified SecOps Platform delete_gsuite_key_file Input Validation Arbitrary File Deletion Vulnerability
This vulnerability allows remote attackers to delete arbitrary files within sensitive directories on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the deletegsuitekeyfile endpoint. The issue...
CVE-2024-44825
Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitrary files unto the system via a crafted .inv3 file...
CVE-2024-21545
Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with 'Sys.Audit' or 'VM.Monitor' privileges to download arbitrary host files via the API. When handli...
CVE-2024-44825
CVE-2024-44825 concerns InVesalius3 (v3.1.99995). Affected component is the .inv3 file handling, enabling a directory traversal that lets an attacker write arbitrary files to the system. The vulnerability is evidenced across multiple feeds (NVD, Red Hat, CIRCL, CVE List) with the core description...
CVE-2024-44825
Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitrary files unto the system via a crafted .inv3 file...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal through the Thumbnails/Add-Type interface in "Image Editor Background Color". An attacker with administrator privileges could add malicious code to the interface by adding a specially crafted background color value...
USN-7030-1 py7zr vulnerability
It was discovered that py7zr was vulnerable to path traversal attacks. If a user or automated system were tricked into extracting a specially crafted 7z archive, an attacker could possibly use this issue to write arbitrary files outside the target directory on the host...
Moxa MXview One
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Moxa Equipment : MXview One, MXview One Central Manager Series Vulnerabilities : Cleartext Storage In A File or On Disk, Path Traversal, Time-of-Check Time-of-Use Race Condition 2. RISK...
CVE-2024-41228
A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary files...
How the Necro Trojan infiltrated Google Play, again
Introduction We sometimes come across modified applications when analyzing suspicious files. These are created in response to user requests for more customization options within the app or for new features that the official versions don't have. Unfortunately, it's not uncommon for popular mods to...
PT-2024-40048 · Unknown · Camaleon Cms
Name of the Vulnerable Software and Affected Versions: Camaleon CMS affected versions not specified Description: The issue concerns a path traversal vulnerability in the MediaController class. An attacker who has taken over an administrator account could delete arbitrary files or folders on the...
CVE-2024-41228
A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary files...
CVE-2024-41228
CVE-2024-41228 describes a symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 . The root cause is a symlink following flaw in the pouch cp operation, enabling attackers to escalate privileges and write arbitrary files. Multiple connected sources corrob...
CVE-2024-41228
A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary files...
CVE-2024-6787
This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used TOCTOU. By exploiting this race condition, an attacker can write arbitrary files to the system. This could allow the attacker to execute malicious code and potentially...
CVE-2024-6787
MXview One Series and MXview One Central Manager are affected by a TOCTOU race condition (CVE-2024-6787) that can enable an attacker to write arbitrary files and potentially execute malicious code. Affected products/versions: MXview One Series <= 1.4.0 and MXview One Central Manager Series
CVE-2024-6787 MXview One Series vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition
This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used TOCTOU. By exploiting this race condition, an attacker can write arbitrary files to the system. This could allow the attacker to execute malicious code and potentially...