Directory traversal

Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a use...

CVE-2024-27121

Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code may be executed by processing a specially crafted request sent from a remote attacker with an...

PT-2024-21660 · Omron · Machine Automation Controller Nj Series +1

Name of the Vulnerable Software and Affected Versions: Machine Automation Controller NJ Series affected versions not specified Machine Automation Controller NX Series affected versions not specified Description: A path traversal vulnerability exists, allowing an arbitrary file in the affected...

CVE-2024-2044

CVE-2024-2044 affects pgAdmin4

OMRON Machine automation controller NJ series Security breaches

Omron Machine automation controller NJ series is a series of machine controllers for logic sequences and motion from Omron Japan. A security vulnerability exists in Omron Machine automation controller NJ series. An attacker can exploit this vulnerability to access arbitrary files or execute...

SUSE SLES12 Security Update : xmlgraphics-batik (SUSE-SU-2024:0777-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0777-1 advisory. - CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability bsc1034675. - CVE-2019-17566: Fixed SSRF vulnerability...

CasaOS Security Vulnerabilities

CasaOS is a simple, easy to use and elegant open source home cloud system. A security vulnerability exists in CasaOS-UserService versions prior to 0.4.6 that stems from lax filtering of URL paths, which allows an attacker to obtain any file on the system...

XenForo Security Vulnerability

XenForo is open source commercial Internet forum software package written in the PHP programming language. A security vulnerability exists in XenForo versions prior to 2.2.14. An attacker can exploit this vulnerability to read arbitrary files on the server running the application...

CVE-2024-1647

Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...

CVE-2024-0849 Leanote 2.7.0 - Local File Read

Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR...

CVE-2024-0849

CVE-2024-0849 (Leanote 2.7.0) is a local-file-read vulnerability caused by a Local File Reading (LFR) weakness, allowing an attacker to obtain arbitrary local files. The vulnerability is explicitly described in multiple sources as affecting Leanote version 2.7.0, with the impact being exposure of...

Leanote Path Traversal Vulnerability

Leanote is an open source notepad application. Leanote version 2.7.0 suffers from a path traversal vulnerability that originates from allowing access to arbitrary local files...

The vulnerability of the NEXO-OS operating system in the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools for assembly work in production lines allows a intruder to gain access to and read arbitrary files.

The vulnerability of the NEXO-OS operating system for tools used in production line assembly work, such as the Bosch Nexo cordless nutrunner and the Bosch Nexo special cordless nutrunner, is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this...

Palantir Gotham Path Traversal Vulnerability

Palantir Gotham is a commercially available, artificial intelligence-enabled operating system from US-based Palantir. A security vulnerability exists in Palantir Gotham blackbird-witchcraft. An attacker exploiting this vulnerability could read arbitrary files on the file system...

php: XML loading external entity without being enabled

A flaw was found in PHP due to inadequate validation of user-supplied XML input. By leveraging specially crafted XML code, a remote attacker could obtain sensitive information by viewing the contents of arbitrary files on the system or initiating requests to external systems. This issue may allow...

CVE-2020-36772

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment...

VulnCheck KEV: CVE-2020-11798

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful...

CVE-2023-35020

IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 257874...

CVE-2023-37932

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability CWE-22 in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests...

VulnCheck KEV: CVE-2018-20470

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal arbitrary file access vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files...