Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

Impact This vulnerability allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. All current stable versions of Electron are affected...

CVE-2021-39184 Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potential...

CVE-2021-40500

SAP BusinessObjects Business Intelligence Platform Crystal Reports - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can enable the...

CVE-2021-40500

CVE-2021-40500 affects SAP BusinessObjects BI Platform (Crystal Reports) versions 420 and 430. The issue stems from missing XML validations at network-exposed endpoints, allowing an unauthenticated attacker to read sensitive data and potentially retrieve arbitrary files from the server. The conne...

CVE-2021-40500

SAP BusinessObjects Business Intelligence Platform Crystal Reports - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over the network and successful exploitation can enable the...

CVE-2021-33722

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system...

CVE-2021-33726

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to download arbitrary files under a user controlled path and does not correctly check if the relative path is still within the intended target directory...

Path traversal

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system...

CVE-2021-33726

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to download arbitrary files under a user controlled path and does not correctly check if the relative path is still within the intended target directory...

CVE-2021-33725

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to delete arbitrary files or directories under a user controlled path and does not correctly check if the relative path is still within the intended target directory...

CVE-2021-33722

Siemens SINEC NMS (versions prior to 1.0 SP2 Update 1) is affected by a path traversal vulnerability when exporting a firmware container. The issue could allow a privileged, authenticated attacker to create arbitrary files on the device. Affected component is the firmware container export path; r...

Schneider Electric IGSS 访问控制错误漏洞

Schneider Electric Interactive Graphical SCADA System IGSS is an advanced SCADA system for monitoring and controlling industrial processes.Schneider Electric Interactive Graphical SCADA System is vulnerable to An access control error vulnerability can be exploited to delete arbitrary files in the...

ProjectSend 路径遍历漏洞

A directory traversal vulnerability exists in ProjectSend version r1295, a free, customer-facing private file sharing Web application. The vulnerability stems from a lack of validation of the input to the files parameter. An attacker could exploit the vulnerability by adding ... /upload/files/...

Tad TadTools Licensing Issue Vulnerability

Tad TadTools is a module toolkit for Tad individual developers in Taiwan, China. Tad TadTools is vulnerable to authorization issues that could be exploited by remote attackers to delete arbitrary files on the system using certain parameters without logging in...

Sophos HitmanPro has an unspecified vulnerability

Sophos HitmanPro is an excellent multi-engine cloud anti-virus scanner from Sophos UK.Sophos HitmanPro suffers from a security vulnerability that stems from a lack of authentication, access control, permission management and other security measures in the network system or product, which could be...

Aruba Instant Path Traversal Vulnerability

Aruba Instant is a wireless network. Aruba Instant provides the only Wi-Fi solution that is easy to set up.A path traversal vulnerability exists in Aruba Instant, which stems from an input validation error when processing directory traversal sequences in the on-the-fly command line interface. An...

SuiteCRM path traversal vulnerability

SuiteCRM, a customer relationship management system from the SuiteCRM Suitecrm team, has a security vulnerability that could allow an attacker to include arbitrary files via the importFile parameter portion of the RefreshMapping import function...

Biqs It Biqs-drive Local File Inclusion Vulnerability

Biqs It Biqs-drive is an online driving school software from the Belgian company Biqs It. BIQS IT Biqs-drive v1.83 and below is vulnerable to a local file inclusion vulnerability, which could be exploited by attackers to read arbitrary files from the server using the privileges of the configured...

SuiteCRM Path Traversal Vulnerability (CNVD-2021-88951)

SuiteCRM is a customer relationship management system from the SuiteCRM Suitecrm team. SuiteCRM has a security vulnerability that allows an attacker to include arbitrary files via the filename parameter portion of the Step3 import function...

MyScada MyDesigner Directory Traversal Vulnerability

MyScada MyDesigner is a rapid development platform for creating visualizations from the Czech company MyScada. mySCADA myDESIGNER version 8.20.0 and below has a security vulnerability that could be exploited by attackers to trick victims into importing a malicious mep file, then they could write...