CVE-2021-29490

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery SSRF attacks via the imageUrl parameter. This issue potentially exposes both internal and...

CVE-2020-27610

The installation procedure in BigBlueButton before 2.2.28 or earlier exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access...

CVE-2024-4981: Files or Directories Accessible to External Parties

A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo...

HackerOne: Internal Access to Hackerone confluence Docs

The vulnerability allowed external access to HackerOne's internal Confluence documentation through a support system misconfiguration. This configuration issue granted the ability to view and modify limited content within the Confluence instance...

CVE-2025-31558

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Greg TailPress tailpress allows Retrieve Embedded Sensitive Data.This issue affects TailPress: from n/a through = 0.4.4...

Malicious code in sfapm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 853b53676c5023f880be7c158c82254598429dca281399a1d04fb433be3e7908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VulnCheck KEV: CVE-2021-39935

GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API...

CVE-2024-48864 File Station 5

A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers to read/write files or directories. We have already fixed the vulnerability in the following versions: File Station 5...

QNAP Systems File Station 安全漏洞

QNAP Systems File Station is a file management tool for QTS from China's Weilian Technology QNAP Systems. The application provides access to NAS files via a web page. A security vulnerability exists in QNAP Systems File Station 5 versions prior to 5.5.6.4741, which stems from a file or directory...

CVE-2025-1540 Incorrect Authorization in GitLab

An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances."...

CVE-2024-12917

Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security Levels, Authentication Abuse. This issue affects Health4All: before 10.01.2025...

CVE-2024-12917 Improper Access Control in Agito Computer's Health4All

Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security Levels, Authentication Abuse. This issue affects Health4All: before 10.01.2025...

Agito Computer Health4All 安全漏洞

Agito Computer Health4All is a health management program from Agito Computer. A security vulnerability exists in Agito Computer Health4All versions prior to 10.01.2025 that stems from improperly restricting the accessibility of a file or directory to external parties, resulting in improperly...

CVE-2022-41738

IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks. IBM X-Force ID: 237812...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the signing verification process, allowing an attacker to replace an existing signed update with another payload and bypass Sparkle’s EdDSA signing checks. Remediation Upgrade...

Malicious code in isctf16 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 236c481ceb4416a920a9cf23c72217913d688a6e2aa10edf1f633acecdaf131b Any computer that has this package installed or running should be...

Malicious code in isctf17 (npm)

The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc935bae7f6f14d33043543fd5ea79225029b59cb212cb9e7336f98619afb98c Any computer that has this package installed or running should be...

CVE-2024-22315 IBM Fusion improper communication restriction

IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container to establish an external network connection...

PT-2025-02: Access to files or directories to external paties in TCPDF

The vulnerability was identified in TCPDF, version 6.8.0. The discovered vulnerability allows an attacker to transmit a specially created HTML file containing an image in Base64 format. Using the specified payload, the attacker can access an arbitrary image outside of the directory. Vulnerability...

Malicious code in libcrypt-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77d47557d62a40299969d264aae617c455ddf31a8ac1bcfac975dc3e27e72d94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...