16891 matches found
Unrestricted file upload
File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do...
Design/Logic Flaw
The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlitehandleupload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be access...
CVE-2024-22567
File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do...
Path Traversal
Atril is vulnerable to Path Traversal. The vulnerability is due to improper file path validation. The attacker can write arbitrary files anywhere on the filesystem to which the user opening a crafted document has access...
CVE-2024-0844
The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementData function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute...
Design/Logic Flaw
IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 260575...
SUSE CVE-2024-22232
A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master's filesystem...
CVE-2023-38019 IBM SOAR QRadar Plugin App directory traversal
IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 260575...
CVE-2024-22096
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system...
Path traversal
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system...
IBM SOAR QRadar Plugin App Directory Traversal Vulnerability
The IBM SOAR QRadar Plugin is a tool from International Business Machines IBM used to provide bi-directional messaging between IBM Security QRadar SIEM and QRadar SOAR. The IBM SOAR QRadar Plugin App suffers from a directory traversal vulnerability that could be exploited by an attacker to send a...
The vulnerability of the software for managing and configuring connected ASUS Armory Crate devices, related to errors in processing hypertext links, allows a perpetrator to gain unauthorized access to arbitrary files.
The vulnerability of the software for managing and configuring connected ASUS Armory Crate devices is related to errors in processing hypertext links. Exploiting this vulnerability can allow an attacker to gain unauthorized access to arbitrary files...
The vulnerability of the args4j plugin for Jenkins’ Git server allows a hacker to read the first two lines of arbitrary files.
The vulnerability of the args4j library plugin for Jenkins’ Git server plugin is related to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow a malicious actor to read the first two lines of arbitrary files...
IBM QRadar SOAR Plug-in 路径遍历漏洞
The IBM SOAR QRadar Plugin is a tool from International Business Machines IBM used to provide bi-directional messaging between IBM Security QRadar SIEM and QRadar SOAR. The IBM SOAR QRadar Plugin App suffers from a directory traversal vulnerability that could be exploited by an attacker to send a...
PT-2024-12679 · Ibm · Ibm Soar Qradar Plugin App
Name of the Vulnerable Software and Affected Versions: IBM SOAR QRadar Plugin App versions 1.0 through 5.0.3 Description: The issue allows a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view...
PT-2024-1517 · Buildkit +3 · Buildkit +3
Name of the Vulnerable Software and Affected Versions: BuildKit versions prior to 0.12.5 Description: A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the hos...
PT-2024-20086 · Unknown · Energy Management Controller
Name of the Vulnerable Software and Affected Versions: Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 versions B0.1.9.1 and earlier Description: The issue allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product due to a path...
CrateDB Path Traversal Vulnerability
CrateDB is a distributed and scalable SQL database from CrateDB, Inc. A path traversal vulnerability exists in CrateDB versions prior to 5.3.9, 5.4.8, 5.5.4, and 5.6.1, which stems from a flaw in the COPY FROM function that can be exploited to import the contents of an arbitrary file into a...
AZL-44319 CVE-2024-23334 affecting package python-aiohttp 3.6.2-3
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...
CVE-2024-23334
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...