XML External Entity (XXE)

owslib is vulnerable to XML External Entity XXE. The vulnerability is due to allowing lxml entity resolution, which allows an attacker to read arbitrary files by parsing a crafted XML document...

CVE-2023-22892

There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arbitrary files from Zephyr instances...

Information disclosure

There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arbitrary files from Zephyr instances...

CVE-2023-22892

There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arbitrary files from Zephyr instances...

Debian: Security Advisory (DLA-657-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

Design/Logic Flaw

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

CVE-2020-36669

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backupguardgetimportbackup function. This makes it possible for unauthenticated attackers to upload...

CVE-2020-36669 JetBackup – WP Backup, Migrate & Restore <= 1.3.9 - Cross-Site Request Forgery to Arbitrary File Upload

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backupguardgetimportbackup function. This makes it possible for unauthenticated attackers to upload...

OWSLib 代码问题漏洞

OWSLib is a Python package for client-side programming using the Open Geospatial Consortium OGC Web Services hence the name OWS interface standard and its associated content model. A code issue vulnerability exists in versions of OWSLib prior to 0.28.1 that stems from an XML parser that does not...

CVE-2022-4328

The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : rsync vulnerabilities (USN-5921-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5921-1 advisory. Koen van Hove discovered that the rsync client incorrectly validated filenames returned by servers. If a user or automated system were...

PT-2023-2117 · NetGear · Netgear Nighthawk Wifi6 Router

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk WiFi6 Router versions prior to V1.0.10.94 Description: The issue is related to the file sharing mechanism in the NETGEAR Nighthawk WiFi6 Router, which allows users with access to this feature to access arbitrary files on the...

The vulnerability of the Cloud Disk cloud storage solution for ASUS RT-AC68U router microprogramming software allows a hacker to write arbitrary files into the system.

The vulnerability of the Cloud Disk cloud storage solution for ASUS RT-AC68U router microprogramming software exists due to incomplete cleaning of temporary resources. Exploiting this vulnerability allows a malicious actor to write arbitrary files into the system remotely...

Information Disclosure

github.com/juju/juju is vulnerable to Information Disclosure. A remote authenticated attacker with access to the control model is able to construct a remote request to download an arbitrary file from the controller's file system and gain access to sensitive information...

Dell PowerScale OneFS Licensing Issue Vulnerability (CNVD-2023-14503)

Dell PowerScale OneFS is an operating system from Dell USA Inc. Dell PowerScale OneFS version 9.4.0.x is vulnerable to an authorization issue that stems from the presence of incorrect default privileges, which could be exploited to overwrite arbitrary files and cause a denial of service...

Design/Logic Flaw

IBM Financial Transaction Manager 3.2.0 through 3.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 192953...

CVE-2020-5001 IBM Financial Transaction Manager path traversal

IBM Financial Transaction Manager 3.2.0 through 3.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 192953...

CVE-2023-22774

Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system...

CVE-2023-22772

An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system...