2552 matches found
RHEL 9 : Red Hat OpenStack Platform 17.0 (openstack-nova) (RHSA-2023:1015)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1015 advisory. OpenStack Compute codename Nova is open source software designed to provision and manage large networks of virtual machines,creating a redundant and...
RHEL 7 / 8 : Synopsis: Red Hat OpenStack Platform (openstack-glance) (RHSA-2023:1280)
The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1280 advisory. OpenStack Image Service code-named Glance provides discovery, registration, and delivery services for virtual disk images. The Image Service API...
RHEL 7 / 8 : Red Hat OpenStack Platform (openstack-swift) (RHSA-2023:1277)
The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1277 advisory. OpenStack Object Storage swift aggregates commodity servers to work together in clusters for reliable, redundant, and large-scale storage of stat...
CVE-2024-3028
mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logofilename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the...
PYSEC-2024-247
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The...
CVE-2024-2083
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically in the /api/v1/steps endpoint. Exploitation opportunities arise by manipulating the logs URI path, bypassing access restrictions due to lack of validation for directory traversal patterns. The issue is descr...
CVE-2024-1483 Path Traversal Vulnerability in mlflow/mlflow
A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifactlocation' and 'source' parameters, using a local URI with '' instead of '?', an attacker can...
CVE-2024-1558 Path Traversal Vulnerability in mlflow/mlflow
A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...
AnythingLLM 输入验证错误漏洞
AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from an input validation error vulnerability that stems from a failure to properly clean user-supplied input, allowing an attacker to read and delete arbitrary files on the server...
Multiple vulnerabilities in a-blog cms
Overview a-blog cms provided by appleple inc. contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability in Entry editing pages CWE-79 - CVE-2024-30419 Server-side request forgery CWE-918 - CVE-2024-30420 Directory traversal CWE-22 - CVE-2024-31394 Stored cross-site...
a-blog cms 安全漏洞
a-blog cms is a Japanese content management system CMS. A security vulnerability exists in a-blog cms versions before Ver.3.1.12, before Ver.3.0.32, before Ver.2.11.61, and before Ver.2.10.53, which originates from a vulnerability that could allow an attacker to log in to the product and obtain...
The vulnerability in the Splunk Web interface of the Splunk Enterprise operating analysis platform allows a malicious actor to read and write arbitrary files into the system.
The vulnerability of the Splunk Enterprise platform for operational analysis is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to read and write arbitrary files into the system using a specially created HTTP...
Exploit for Improper Access Control in Adobe Coldfusion
CVE-2024-20767 Exploit for Adobe ColdFusion 🛠️ This repositor...
CVE-2024-2227
IdentityIQ (SailPoint) is affected by a JavaServer Faces path traversal vulnerability (JSF 2.2.20) that allows reading arbitrary files from the application server filesystem. Root cause: path traversal in JSF 2.2.20, as described in CVE-2020-6950 lineage. Affected IdentityIQ versions include 8.3 ...
CVE-2024-2294 Backuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backupname parameter in the backuplydownloadbackup function. This makes it possible for attackers to have an account with only...
PT-2024-19622 · WordPress · Backuply
Name of the Vulnerable Software and Affected Versions: The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress versions up to, and including, 1.2.7 Description: The issue allows attackers with an account that has only the activate plugins capability to access arbitrary files on the...
Directory traversal
Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a use...
CVE-2024-27121
Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code may be executed by processing a specially crafted request sent from a remote attacker with an...
PT-2024-21660 · Omron · Machine Automation Controller Nj Series +1
Name of the Vulnerable Software and Affected Versions: Machine Automation Controller NJ Series affected versions not specified Machine Automation Controller NX Series affected versions not specified Description: A path traversal vulnerability exists, allowing an arbitrary file in the affected...