8014 matches found
PT-2024-25226 · Unknown · Novel-Plus
Name of the Vulnerable Software and Affected Versions: novel-plus versions 4.3.0 and earlier Description: The issue allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter. This enables the attacker to read arbitrary files, potentially leadi...
BuddyForms < 2.8.9 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery
Description The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to Arbitrary File Read and Server-Side Request Forgery in all versions up to, and including, 2.8.8. This makes it possible for...
Arbitrary File Read Vulnerability in Electronic Document Security Management System (CDG) of Beijing Yisetong Technology Development Co.
Yisetong Document Security Management System is the earliest document encryption and decryption product in China based on file filtering and driving technology. The protection scope covers terminal computers Windows, Mac, and Linux system platforms, smart terminals Android, IOS, and all kinds of...
RHEL 8 : OpenShift Container Platform 4.10.51 (RHSA-2023:0560)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:0560 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...
WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability
Arbitrary File Read and Phar Deserialization vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Element Pack Pro versions 7.19.3...
CVE-2022-45852 WordPress WP-FormAssembly plugin <= 2.0.5 - Auth. Arbitrary File Read vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Path Traversal.This issue affects WP-FormAssembly: from n/a through 2.0.5...
CVE-2022-45852 WordPress WP-FormAssembly plugin <= 2.0.5 - Auth. Arbitrary File Read vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Path Traversal.This issue affects WP-FormAssembly: from n/a through 2.0.5...
PT-2024-8118 · Rockwell Automation · Thinmanager Thinserver
Name of the Vulnerable Software and Affected Versions: Rockwell Automation ThinManager ThinServer versions 11.1.0 through 11.1.7 Rockwell Automation ThinManager ThinServer versions 11.2.x Rockwell Automation ThinManager ThinServer versions 12.x Rockwell Automation ThinManager ThinServer versions...
WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability
WordPress buddyforms plugin = 2.8.8- Arbitrary File Read and SSRF vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin BuddyForms versions = 2.8.8...
Adobe ColdFusion Arbitrary File Read
Adobe ColdFusion prior to versions 2021 Update 13 or 2023 Update 7, suffer from an Improper Access Control vulnerability that could lead to arbitrary file system read. By leveraging this vulnerability, a remote unauthenticated attacker can access to sensitive files and perform arbitrary file syst...
Italtel Embrace 安全漏洞
Italtel Embrace is a software-only, cloud-enabled Web application server from Italtel. It can be used to enable WebRTC services in a TLC network or as a standalone WebRTC service. A security vulnerability exists in Italtel Embrace version 1.6.4, which stems from an arbitrary file read vulnerabili...
Path Traversal
mlflow/mlflow is vulnerable to a Path Traversal. The vulnerability is due to improper validation of the source parameter within handlers.py, allowing attackers to craft a parameter that bypasses checks, leading to arbitrary file read access on the server...
GHSA-J62R-WXQQ-F3GF mlflow vulnerable to Path Traversal
A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...
mlflow vulnerable to Path Traversal
A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...
CVE-2024-1561 Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio
An issue was discovered in gradio-app/gradio, where the /componentserver endpoint improperly allows the invocation of any method on a Component class with attacker-controlled arguments. Specifically, by exploiting the moveresourcetoblockcache method of the Block class, an attacker can copy any fi...
CVE-2024-1558 Path Traversal Vulnerability in mlflow/mlflow
A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...
CVE-2024-1558 Path Traversal Vulnerability in mlflow/mlflow
A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...
The vulnerability of the Jenkins Git Log command’s plugin involves an incorrect restriction on the path name for the restricted directory. This allows a malicious user to read the content from any arbitrary file.
The vulnerability of the Jenkins Git Log Command plugin is related to the operation of the command syntax analyzer function. This function replaces the symbol “@”, which is followed by a path to a file in the argument containing the file’s content. Exploiting this vulnerability allows an attacker...
Oracle Reports Servlet Arbitrary File Read
An unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 can allow a remote attacker to use this vulnerability to read or write arbitrary files on the system, ultimately leading to remote code execution. No source data...
