CVE-2025-8048

External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local file path and then download the specified file from the system by requesting the stored document ID. This issue affects Flipper: 3.1.2...

CVE-2025-8048 External Control of File path vulnerability has been discovered on Openext Flipper.

External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local file path and then download the specified file from the system by requesting the stored document ID. This issue affects Flipper: 3.1.2...

EUVD-2025-34498

Not used...

EUVD-2015-7325

Malware in sbrugna...

EUVD-2019-5893

Malware in sbrugna...

EUVD-2025-30292

Malicious code in bioql PyPI...

EUVD-2025-31670

Malicious code in bioql PyPI...

EUVD-2025-32071

Malicious code in bioql PyPI...

EUVD-2025-31813

Malicious code in bioql PyPI...

CVE-2019-3965

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the documentid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CGA-MMGJ-2Q2J-78V4

Bulletin has no description...

CVE-2024-51210

Firepad 1.5.11 and earlier versions are affected. Remote attackers who know a pad ID can retrieve the current document text and all previously pasted content due to an access-control vulnerability; several listings note this behavior is intentional for known document IDs/URLs. The maintainer-stat...

CVE-2023-43900

Insecure Direct Object References IDOR in EMSigner v2.8.7 allow attackers to gain unauthorized access to application content and view sensitive data of other users via manipulation of the documentID and EncryptedDocumentId parameters...

CVE-2021-43448

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known...

PT-2023-12452 · Unknown · Onlyoffice

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE all versions as of 2021-11-08 Description: The issue is related to Improper Input Validation, which can be exploited if the document id is known, allowing an attacker to spoof user names who interact with a document. Recommendation...

CVE-2021-43448

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known...

NCH Quorum 跨站脚本漏洞

NCH Quorum is software that runs as a teleconferencing server on a Windows PC. A cross-site scripting vulnerability exists in NCH Quorum 2.03 and earlier versions. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via /uploaddoc?id=...

Vulnerability fixed in Elasticsearch

Elastic has fixed a vulnerability in Elasticsearch. A remote malicious party could potentially exploit the vulnerability to gain access to sensitive data. The vulnerability is in the way Document or Field permissions are applied. A malicious party can view recently modified documents because they...

CVE-2021-22134

A flaw was found in elasticsearch. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of...

Tangro Business Workflow Authorization Issues Vulnerability (CNVD-2020-74068)

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A vulnerability exists in Tangro Business Workflow prior to version 1.18.1 due to an authorization issue, which stems from a...