CVE-2015-2074

The File Repository Server FRS CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to write to arbitrary files via a full pathname, aka SAP Note 2018681...

CVE-2021-24499 Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

The Workreap WordPress theme before 2.2.2 AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp...

SUSE SLES12 Security Update : fastjar (SUSE-SU-2021:2635-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:2635-1 advisory. - CVE-2010-2322: Fixed a directory traversal vulnerabilities. bsc1188517 Tenable has extracted the preceding description block directly from...

CVE-2021-22234

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server...

UBUNTU-CVE-2021-22234

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server...

CVE-2021-22234

Removed by vendor...

CVE-2021-22234

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 before 13.12.8, and all versions starting from 14.0 before 14.0.4. A specially crafted design image allowed attackers to read arbitrary files on the server...

The vulnerability of the Event Banner plugin for the WordPress content management system allows for unlimited loading of dangerous files, enabling attackers to load and execute arbitrary files.

The vulnerability of the Event Banner plugin for the WordPress content management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to download and execute arbitrary files remotely...

CVE-2021-36741

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the...

Input validation

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the...

CVE-2021-32000

A UNIX Symbolic Link Symlink Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files. This issue affects: SUSE Linux...

Design/Logic Flaw

A UNIX Symbolic Link Symlink Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files. This issue affects: SUSE Linux...

CVE-2021-32000

CVE-2021-32000 is a local privilege issue in the clone-master-clean-up.sh script of the clone-master-clean-up utility. A UNIX symlink following vulnerability could allow local attackers to delete arbitrary files on SUSE Linux Enterprise Server 12 SP3 (1.6-4.6.1 and earlier) and 15 SP1 (1.6-3.9.1 ...

FreeRDP 输入验证错误漏洞

FreeRDP is an open source implementation of the Remote Desktop Protocol RDP by the FreeRDP Freerdp team. FreeRDP suffers from an input validation error vulnerability that stems from clipboard redirection being enabled by default. An attacker could read arbitrary files from a connected client...

NCH Axon PBX Directory Traversal Vulnerability

NCH Axon PBX is a set of virtual telephone switch software used in commercial environments. The NCH Axon PBX has a security vulnerability that could be exploited by an attacker to send a constructed URL request to the logprop function, which contains a "dot-dot" sequence in the file parameter /...

NCH Axon PBX Directory Traversal Vulnerability (CNVD-2021-55910)

NCH Axon PBX is a set of virtual telephone switch software used in commercial environments. The NCH Axon PBX has a security vulnerability that could be exploited to send a constructed URL request to the logdelete function, which contains the "dot-dot" sequence in the file parameter /... /. to vie...

NCH Axon PBX 路径遍历漏洞

NCH Axon PBX is a set of virtual telephone switch software used in commercial environments. The NCH Axon PBX has a security vulnerability that could be exploited by an attacker to send a constructed URL request to the logprop function, which contains a "dot-dot" sequence in the file parameter /...

in alovoa/alovoa

✍️ Description Affected versions of this package are vulnerable to XML External Entity XXE Injection via the SAML2AssertionValidator method. Access to external entities was not disabled in XML parsing. 🕵️‍♂️ Proof of Concept org.springframework.security spring-security-oauth2-client...

CVE-2021-34700

A vulnerability in the CLI interface of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read arbitrary files on the underlying file system of an affected system. This vulnerability exists because access to sensitive information on an affected system is not sufficient...

CVE-2021-1617

Multiple vulnerabilities in the web-based management interface of Cisco Intersight Virtual Appliance could allow an authenticated, remote attacker to conduct a path traversal or command injection attack on an affected system. These vulnerabilities are due to insufficient input validation. An...