vbox-guestctrl-copyfrom-dotdot

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vbox-guestctrl-copyfrom-dotdot Write-up: https://abraxaslabs.tech/research/virtualbox-7-2-20-leftovers vbox-guestctrl-copyfrom-dotdot Class: File write Reach: Local guest confused-deputy Oracle VM VirtualBox OSS 7.2.2...

vsftpd-deny-file-brace-child

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vsftpd-deny-file-brace-child Write-up: https://abraxaslabs.tech/research/vsftpd-deny-file-brace-child vsftpd-deny-file-brace-child Class: Privilege leftover Reach: Remote vsftpd 3.0.5 - Chris Evans The man page...

spark-history-store-path

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-history-store-path Write-up: https://abraxaslabs.tech/research/spark-history-store-path spark-history-store-path Class: File write config-gated Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software...

mysql-mysqldump-tab-path

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · mysql-mysqldump-tab-path Write-up: https://abraxaslabs.tech/research/mysql-mysqldump-tab-path mysql-mysqldump-tab-path Class: File write client Reach: Remote UI:R MySQL Community Server mysqldump 26.7.0 06a5c1c - Orac...

pfsense-cp-filemanager-write

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-cp-filemanager-write pfsense-cp-filemanager-write Class: File write Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Upload name is not basename. A name that already contains captiveportal- ski...

forgejo-restore-file-open

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · forgejo-restore-file-open Write-up: https://abraxaslabs.tech/research/forgejo-restore-file-open forgejo-restore-file-open Class: File read Reach: Local Forgejo 16.0.5 8d24b7d - Forgejo forgejo restore-repo of an...

spark-connect-archive-fragment

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-connect-archive-fragment Write-up: https://abraxaslabs.tech/research/spark-connect-archive-fragment spark-connect-archive-fragment Class: File write Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software...

Joomla! Component Love Factory 1.3.4 - Local File Inclusion

A directory traversal vulnerability in the Love Factory comlovefactory component 1.3.4 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1957 info: name: Joomla! Component Love Factory 1.3.4 - Local File Inclusion...

ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access. id: CVE-2024-1708 info: name: ConnectWise ScreenConnect = 23.9.7 - Path Traversal...

qdPM 9.2 - Directory Traversal

qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. id: CVE-2023-45855 info: name: qdPM 9.2 - Directory Traversal author: DhiyaneshDk severity: high description: | qdPM 9.2 allows Directory Traversal to list files and directories by navigating to t...

Essential Blocks < 4.4.3 - Local File Inclusion

Wordpress Essential Blocks plugin prior to 4.4.3 was discovered to be vulnerable to a significant Local File Inclusion vulnerability that may be exploited by any attacker, regardless of whether they have an account on the site. id: CVE-2023-6623 info: name: Essential Blocks 4.4.3 - Local File...

Nezha Dashboard < 2.0.13 - Path Traversal

Nezha Monitoring 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs. id: CVE-2026-53519 info: name: Nezha Dashboard 2.0.13 - Path Traversal author: Aryu-RU,str4k3r severity...

Sharp Multifunction Printers - Directory Listing

It was observed that Sharp printers are vulnerable to an arbitrary directory listing without authentication. Any attacker can list any directory located in the printer and recover any file. id: CVE-2024-33605 info: name: Sharp Multifunction Printers - Directory Listing author: gy741 severity: hig...

MLflow <= 3.9.0 - Arbitrary File Read

mlflow mlflow = 3.9.0 contains a path traversal caused by bypassing source path validation via the mlflow.prompt.isprompt tag in CreateModelVersion request, letting unauthenticated remote attackers read arbitrary files. id: CVE-2026-2614 info: name: MLflow = 3.9.0 - Arbitrary File Read author:...

JFinalCMS v5.0.0 - Directory Traversal

An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. id: CVE-2023-41599 info: name: JFinalCMS v5.0.0 - Directory Traversal author: pussycat0x severity: medium description: | An issue in the component /common/DownController.ja...

Meshery <1.0.57 - Arbitrary File Read

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read

Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The original image-cache route /cache/original/filename passes the user-supplied filename to getImagePath without any '..' filtering or realpath containment, allowing a remote unauthenticated...

Schools Alert Management Script - Arbitrary File Read

Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. id: CVE-2018-12054 info: name: Schools Alert Management Script - Arbitrary File Read author: wisnupramoedya severity: high description: Schools Alert...

Joomla! Component User Status - Local File Inclusion

A directory traversal vulnerability in userstatus.php in the User Status comuserstatus component 1.21.16 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1304 info: name: Joomla! Component User Status - Local File...

DOMOS 5.5 - Local File Inclusion

SECUDOS DOMOS before 5.6 allows local file inclusion via the log module. id: CVE-2019-18665 info: name: DOMOS 5.5 - Local File Inclusion author: 0xAkoko severity: high description: | SECUDOS DOMOS before 5.6 allows local file inclusion via the log module. impact: | Successful exploitation of this...