CVE-2024-29073

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. ...

DEBIAN-CVE-2024-29073

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. ...

UBUNTU-CVE-2024-29073

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. ...

UBUNTU-CVE-2024-32484

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability...

CVE-2024-29073

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. ...

CVE-2024-29073

Anki (Ankitects) 24.04 is affected by CVE-2024-29073 due to incomplete sanitization of LaTeX: the verbatim package is not properly handled, enabling a specially crafted flashcard to read arbitrary files. The issue is triggered by sharing a flashcard; no fix/version remediation is provided in the ...

CVE-2024-29073

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. ...

CVE-2024-32484

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability...

CVE-2024-32484

Affected product: Ankitects Anki (entries reference Anki up to 25.02). The connected documents indicate CVE-2025-43703 describes an incomplete fix for CVE-2024-32484, resulting in attacker‑controlled access to the internal API via crafted decks/SRC attributes, effectively enabling scripted access...

CVE-2024-32484

Removed by vendor...

CVE-2024-32484

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability...

Ankitects Anki Latex Incomplete Blocklist Vulnerability

Talos Vulnerability Report TALOS-2024-1992 Ankitects Anki Latex Incomplete Blocklist Vulnerability July 22, 2024 CVE Number CVE-2024-29073 SUMMARY An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package,...

PT-2024-28768 · Ip Guard · Ip Guard

Name of the Vulnerable Software and Affected Versions: IP Guard version 4.81.0307.0 Description: The issue allows for an arbitrary file read via the file name parameter. Recommendations: For IP Guard version 4.81.0307.0, consider restricting access to the file name parameter to minimize the risk ...

CVE-2024-40051

IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter...

Ankitects Anki Flask Invalid Path Reflected Cross-Site Scripting (XSS) vulnerability

Talos Vulnerability Report TALOS-2024-1995 Ankitects Anki Flask Invalid Path Reflected Cross-Site Scripting XSS vulnerability July 22, 2024 CVE Number CVE-2024-32484 SUMMARY An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A...

CVE-2024-40051

IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter...

Anki Latex Incomplete Blocklist Vulnerability

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. ...

CVE-2024-40051

CVE-2024-40051 affects IP Guard v4.81.0307.0, which is reported to contain an arbitrary file read vulnerability exploitable via the file name parameter. Public sources across Red Hat and NVD reiterate the same description: the issue allows reading arbitrary files, with CVSS 3.1/AV:N/AC:L/PR:N/UI:...

CVE-2024-40628 Arbitrary File Read in Ansible Playbooks in Jumpserver

JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the ansible playbook to read arbitrary files in the celery...

jenkins-2-plugins: git-server plugin arbitrary file read vulnerability

A flaw was found in the Git Server Plugin for Jenkins. This issue could allow an attacker to read the first two lines of arbitrary files on the server's file system...