CVE-2023-34216 Second Order Command-injection Vulnerability in the Key-delete Function

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability derives from insufficient input validation in the key-delete function, which could potentially allow malicious users to...

TurboWarp 安全漏洞

TurboWarp is a TurboWarp open source application. A security vulnerability exists in versions prior to TurboWarp 1.8.0 that stems from allowing a malicious project or custom extension to read arbitrary files from disk and upload them to a remote server...

PDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportAsTex...

ThinManager Path Traversal (CVE-2023-2915) Arbitrary File Delete

This module exploits a path traversal vulnerability CVE-2023-2915 in ThinManager use auxiliary/admin/networking/thinmanager/traversaldelete msf undefinedtraversaldelete show actions ...actions... msf undefinedtraversaldelete set ACTION msf undefinedtraversaldelete show options ...show and set...

CVE-2023-38402

A vulnerability in the HPE Aruba Networking Virtual Intranet Access VIA client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could allow these malicious users to create a Denial-of-Service DoS condition affecting the Microsoft Windows...

Ivanti Avalanche FileStoreConfig Arbitrary File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileStoreConfig endpoint. The issue results from the lack of proper validation of...

Ivanti Avalanche FileStoreConfig Arbitrary File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileStoreConfig app. The issue results from the lack of proper validation of...

Arbitrary File Reads

github.com/1panel-dev/1panel is vulnerable to Arbitrary File Reads. The vulnerability exists in LoadFromFile at file.go due to not restricting the request parameters which allows an attacker to directly read arbitrary files on the system...

The vulnerability of the Accessibility component in Google Chrome allows a perpetrator to read and write arbitrary files.

The vulnerability of the Accessibility component in Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to read and write arbitrary files using a specially crafted HTML page...

zola path traversal vulnerability

zola is a fast static site generator in a binary with everything built in. A security vulnerability exists in zola versions 0.13.0 through 0.17.2, which stems from a path traversal vulnerability in which the handlerequest function does not filter for special path controllers in the URL. An attack...

Improper validation of intent data received in TextViewerActivity allows opening of arbitrary files

Description Tested on Build87 of the Inure application. It was discovered that the application had an exported activity .activities.association.TextViewerActivity which accepted intent data via the file scheme + text/ mime type and opened the associated files from provided URI data string. It is...

The vulnerability in the SCADA web interface of TelWin SCADA allows a hacker to read arbitrary files.

The vulnerability of the SCADA interface of TelWin SCADA is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...

The vulnerability of the Google Chrome browser’s Media component, which allows a hacker to read and write arbitrary files.

The vulnerability of the Google Chrome browser’s Media component is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to read and write arbitrary files using a specially crafted HTML page...

The vulnerability of Google Chrome’s user interface allows a perpetrator to read and write arbitrary files.

The vulnerability of Google Chrome’s user interface is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to read and write arbitrary files using a specially crafted HTML page...

CVE-2023-39965 1Panel Unauthorized access in Backend

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may caus...

Improper Input Validation

prestashop/prestashop is vulnerable to Improper Input Validation. The vulnerability exists in the delete function of Attachment.php because the file parameter is not properly handled which allows an attacker to delete arbitrary files...

Design/Logic Flaw

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.4. The affected applications accept unauthenticated file write messages. An unauthenticated remote attacker could write arbitrary files to the affected application's file system...

CVE-2023-37373

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.4. The affected applications accept unauthenticated file write messages. An unauthenticated remote attacker could write arbitrary files to the affected application's file system...

Path Traversal

github.com/projectdiscovery/nuclei is vulnerable to Path Traversal. The vulnerability exists when to the sandbox feature is turned on, which results in path traversal due to lack of sanitization when loading payloads, resulting in attacker to reading arbitrary files in the file system...

Alteryx Server Cross-Site Scripting Vulnerability

Alteryx Server is a cloud-hosted or self-hosted application from Alteryx, Inc. for publishing, sharing, and executing workflows. A cross-site scripting vulnerability exists in Alteryx Server version 2022.1.1.42590, which stems from not performing type validation on uploaded files, allowing an...