PT-2025-1074

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition affected versions not specified Description The issue is related to an arbitrary file deletion vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to delete...

The vulnerability of the Keycloak identity and access management software lies in improper external control of the file name or path, allowing unauthorized users to gain unauthorized access to protected information.

The vulnerability of the Keycloak identity and access management software is related to improper external control of the file name or path, resulting from incorrect validation of regular expressions. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthoriz...

RockyLinux 9 : bubblewrap and flatpak (RLSA-2024:9449)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:9449 advisory. flatpak: Access to files outside sandbox for apps using persistent= --persist CVE-2024-42472 Tenable has extracted the preceding description block directly from t...

The vulnerability of the Portal for ArcGIS web portal, related to improper external management of file names or paths, allows a perpetrator to disclose protected information.

The vulnerability of the Portal for ArcGIS is related to improper external management of the file name or path. Exploiting this vulnerability can allow a malicious actor to disclose protected information through a specially created web page...

CVE-2023-5816

The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only...

CVE-2023-5816 Code Explorer <= 1.4.5 - Authenticated (Admin+) External File Reading

The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is due to the fact that the plugin does not restrict accessing files to those outside of the WordPress instance, though the intention of the plugin is to only...

CVE-2023-5816

CVE-2023-5816 concerns the WordPress plugin Code Explorer (

WordPress plugin Code Explorer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Code Explorer plugin <= 1.4.5 - Authenticated (Admin+) External File Reading vulnerability

Authenticated Admin+ External File Reading vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Code Explorer versions = 1.4.5...

VMware Spring Framework 安全漏洞

VMware Spring Framework is a set of open source Java, JavaEE application frameworks from VMware. The framework helps developers build high-quality applications. A security vulnerability exists in VMware Spring Framework. An attacker can exploit the vulnerability to read files outside of the servi...

The vulnerability of the Rockwell Automation Emulate3D software for virtual modeling of equipment and manufacturing processes lies in improper external control of file names or file paths, allowing a hacker to execute arbitrary code.

The vulnerability of the Rockwell Automation Emulate3D software for virtual modeling of equipment and manufacturing processes is related to improper external manipulation of file names or DLL files during library loading. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Important: qemu

Issue Overview: QEMU: sdhci: heap buffer overflow in sdhciwritedataport CVE-2024-3447 A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to...

PT-2024-6549 · Microsoft · Outlook

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook affected versions not specified Description: The issue is related to incorrect external control of a file name or path in Microsoft Outlook for Windows operating systems. Exploitation of this issue may allow an attacker to...

CVE-2024-38432

Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File...

CVE-2024-38432

Matrix Tafnit v8 - CWE-646: Reliance on File Name or Extension of Externally-Supplied File...

PT-2024-28001 · Unknown · Matrix Tafnit

Name of the Vulnerable Software and Affected Versions: Matrix Tafnit version 8 Description: The issue is related to reliance on the file name or extension of externally-supplied files, as indicated by CWE-646. Recommendations: For Matrix Tafnit version 8, at the moment, there is no information...

qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...

qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...

PT-2024-19805 · Unknown · Controller 6000 +1

Name of the Vulnerable Software and Affected Versions: Controller 6000 and Controller 7000 versions 8.60 and prior Controller 6000 and Controller 7000 versions 8.70 prior to vCR8.70.240520a Controller 6000 and Controller 7000 versions 8.80 prior to vCR8.80.240520a Controller 6000 and Controller...

qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...