GHSA-PVHV-QWC8-R2PG Plone Arbitrary File Read

atdownload.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs Files and Images stored on custom content types via a crafted URL...

django-markupfield Arbitrary File Read

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXTFILTERSETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors...

GHSA-WXMR-7XJV-8XQW django-markupfield Arbitrary File Read

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXTFILTERSETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors...

GHSA-MPMF-HR8P-P49G Sanic arbitrary file read and directory traversal

Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring...

CmsEasy 安全漏洞

CmsEasy is a content management system CMS for creating responsive websites from China's Jiuzhou eTong Technology Company. A security vulnerability exists in CmsEasy version 7.7.520211012, which stems from being affected by an arbitrary file read vulnerability. An attacker can exploit the...

Cloudflare Public Bug Bounty: Arbitrary file read from Cloudflare Pages build environment

A vulnerability in Cloudflare Pages allowed attackers to escalate privileges during the build process, enabling arbitrary file reads. Cloudflare implemented more restrictive input validation on the redirects and headers feature to resolve the issue. The build environment is scoped to each Pages...

GHSA-9JRH-HCH8-RR5C Jenkins Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system

An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapper.java that allows attackers with permission to configure jobs to read arbitrary files from the Jenkins master file system...

GHSA-CWCF-5M5W-MQ2W Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin

A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system...

DOMPDF Arbitrary File Read

dompdf.php in dompdf before 0.6.1, when DOMPDFENABLEPHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the inputfile parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the...

GHSA-QR6Q-W4GJ-3865 DOMPDF Arbitrary File Read

dompdf.php in dompdf before 0.6.1, when DOMPDFENABLEPHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the inputfile parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the...

GHSA-QPRX-Q2R7-3RX6 Improper Input Validation in Apache Tomcat

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a...

Debian DLA-3002-1 : adminer - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-3002 advisory. - Improper Access Control in Adminer versions 1.12.0 to 4.6.2 fixed in version 4.6.3 allows an attacker to achieve Arbitrary File Read on the remote server by requesting th...

CVE-2022-24830 Path Traversal in OpenClinica

OpenClinica is an open source software for Electronic Data Capture EDC and Clinical Data Management CDM. OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote code execution. There are no known...

CVE-2022-24830 Path Traversal in OpenClinica

OpenClinica is an open source software for Electronic Data Capture EDC and Clinical Data Management CDM. OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote code execution. There are no known...

[SECURITY] [DLA 3002-1] adminer security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3002-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb May 13, 2022 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...

GHSA-4CCX-WJQP-5FWW LibreNMS Arbitrary File Read

The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php...

LibreNMS Arbitrary File Read

The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php...

Cobbler Arbitrary File Read

A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation...

GHSA-4VC9-4XPQ-77VM Cobbler Arbitrary File Read

A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation...

GHSA-GJFX-9WX3-J6R7 Apache MyFaces Vulnerable to Path Traversal

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces JSF in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. dot dot in the 1 ln parameter to faces/javax.faces.resource/web.xml or 2 the PATHINFO to...