16895 matches found
AnythingLLM Security Vulnerability
AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM. An attacker exploiting this vulnerability could set its profile picture via the front-end API using a relative file path and then download any valid file using the PFP GET API...
CVE-2023-6585 JobSearch WP Job Board < 2.3.4 - Arbitrary File Upload to RCE
The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server...
PT-2024-15650 · Git +2 · Anything-Llm +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A user who is already privileged as manager or admin can exploit this issue by setting their profile picture via the frontend API using a relative...
MikroTik RouterOS Link Following (CVE-2022-34960)
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location on the host. This plugin only works with Tenable.ot. Please...
MikroTik RouterOS Improper Limitation of a Pathname to a Restricted Directory (CVE-2018-14847)
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface. This plugin only works with Tenable.ot. Please visit...
MikroTik RouterOS Path Traversal (CVE-2019-15055)
MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator...
Path traversal
In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote attackers to write to arbitrary files via a crafted filename parameter in requests to the /upload endpoint...
Design/Logic Flaw
The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with subscriber-level access and above, to...
Arbitrary File Read
Appwrite is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of user-supplied input when creating an ACME challenge file, allowing an attacker to manipulate the request URI to access arbitrary files. The vulnerability is only exploitable if the...
LG webOS Security Vulnerability
LG webOS is a Linux kernel-based smart TV operating system from South Korea's LG. A security vulnerability exists in LG webOS. An attacker could exploit the vulnerability to read arbitrary files on the server running the application...
CVE-2023-49960
In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote attackers to write to arbitrary files via a crafted filename parameter in requests to the /upload endpoint...
The vulnerability of the codeplex-codehaus framework built with Apache Maven allows a hacker to gain unauthorized access to arbitrary files and directories.
The vulnerability of the codeplex-codehaus framework built with Apache Maven is related to an incorrect restriction on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to arbitrary files...
GHSA-P3RV-QJ56-2FQX Cross-site Scripting in Pyhtml2pdf
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
Hardcoded credentials
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
Hardcoded credentials
electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...
K000132800: F5OS QKView utility vulnerability CVE-2024-23607
Security Advisory Description A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory. CVE-2024-23607 Impact An authenticated attacker may exploit this vulnerability by executing a crafted QKView utilit...
MoveTo <= 6.2 - Unauthenticated Directory Traversal to Arbitrary File Deletion
Description The moveto plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, leading to site takeover...
Remote code execution
A vulnerability has been identified in SINEC NMS All versions V2.0 SP1. The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution...
CVE-2024-0167
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svctopstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files on the file system with root privileges...
CVE-2024-0167
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svctopstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files on the file system with root privileges...