pki-core: access to external entities when parsing XML can lead to XXE

A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...

Samsung Mobile Devices Improper Access Control Vulnerability

Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370...

CVE-2022-3418

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files...

Simple E-Learning System 安全漏洞

Simple E-Learning System is a simple e-learning system from Carlo Montero's personal developer. version v1.0 of Simple E-Learning System is vulnerable to information disclosure, which can be exploited by attackers to read arbitrary files resulting in information disclosure...

CVE-2022-43319

An information disclosure vulnerability in the component vcs/downloadFiles.php?download=./search.php of Simple E-Learning System v1.0 allows attackers to read arbitrary files...

CVE-2022-38582

Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files...

Improper access control

Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files...

CVE-2022-38582

Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files...

Amazon Linux 2022 : rsync, rsync-daemon (ALAS2022-2022-158)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-158 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large numbe...

CVE-2022-42745

CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE...

AlmaLinux 9 : pki-core (ALSA-2022:7326)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:7326 advisory. - Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve th...

Security Bulletin: Potential vulnerability in Apache Commons IO affect IBM Operations Analytics - Log Analysis (CVE-2021-29425)

Summary Prior to version 2.7 vulnerability in Apache Commons IO allow remote attacker to traverse directories on the system to view arbitrary files Vulnerability Details CVEID:CVE-2021-29425 DESCRIPTION: Apache Commons IO could allow a remote attacker to traverse directories on the system, caused...

Archive_Tar: directory traversal due to inadequate checking of symbolic links

A flaw was found in the ArchiveTar package. ArchiveTar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences /../ to modify...

WatchTowerHQ < 3.6.16 - Unauthenticated Arbitrary File Access

The plugin does properly check for the access token in its REST API endpoints, which could allow unauthenticated attackers to call them and download arbitrary files...

CVE-2022-41657

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operation application programmable interfaces APIs. This could create arbitrary files, which could be used in API operations and could ultimately...

CVE-2022-41657

Delta Electronics InfraSuite Device Master (versions 00.00.01a and earlier) is affected by multiple CVEs describing an in-memory deserialization/vector issue in file operation APIs that can lead to arbitrary file creation and remote code execution. ZDI advisories for CtrlLayerNWCmd_FileOperation ...

CVE-2022-39022

U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file...

CVE-2022-39023

U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to download arbitrary system file...

File Upload Vulnerability in Huatian Power OA System (CNVD-2022-83472)

Huatian Power OA system is a collaborative office software developed by Dalian Huatian Software Co. A file upload vulnerability exists in the Huatian Power OA system, which can be exploited by an attacker to upload arbitrary files...

e-Excellence U-Office Force 路径遍历漏洞

e-Excellence U-Office Force is an e-Office platform from China's First Class Technology e-Excellence. U-Office Force suffers from a path traversal vulnerability, which arises from its download feature that allows a remote attacker with common privileges to traverse the path and download arbitrary...