CVE-2023-4550

Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server on which it is hosted. Thi...

OpenText AppBuilder Security Vulnerability

OpenText AppBuilder is an application from OpenText Canada. A security vulnerability exists in OpenText AppBuilder versions 21.2 through 23.2, which arises from incorrect input validation, and an externally accessible file or directory vulnerability that allows probing of system files...

jupyterlab-lsp Security Vulnerabilities

jupyterlab-lsp is a tool that provides coding help for JupyterLab using the Language Server protocol. A security vulnerability exists in jupyterlab-lsp 2.2.1 and earlier versions, which stems from a lack of authentication of the jupyter-lsp server extension endpoint, allowing an attacker to acces...

PT-2023-31465

Name of the Vulnerable Software and Affected Versions WireMock with GUI versions 3.0.4.0 through 3.2.0.0 Description The issue concerns stored cross-site scripting SXSS through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker's...

The vulnerability of the Apache Struts software platform, related to the use of files and directories accessible from external parties, allows a hacker to execute arbitrary code.

The vulnerability of the Apache Struts software platform is related to the use of files and directories accessible from external parties due to incorrect restrictions on the path to the restricted directory during file loading. Exploiting this vulnerability allows a remote attacker to execute...

Mitsubishi Electric FA Engineering Software Security Vulnerability

Mitsubishi Electric FA Engineering Software is a series of engineering software from Mitsubishi Electric Japan. A security vulnerability exists in Mitsubishi Electric FA Engineering Software, which is a malicious code execution vulnerability that originates from an externally controlled file name...

PT-2023-7417 · Mitsubishi · Gx Works3 +4

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric FA Engineering Software Products affected versions not specified MELSOFT iQ AppPortal affected versions not specified MELSOFT Navigator affected versions not specified Motion Control Setting affected versions not specified...

The vulnerability of NVIDIA Virtual GPU driver relates to the use of files and directories accessible from external parties. This allows attackers to gain unauthorized access to protected information, enhance their privileges, execute arbitrary code, or cause service interruptions.

The vulnerability of NVIDIA Virtual GPU driver relates to the use of files and directories accessible from external parties. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information, enhance their privileges, execute arbitrary code, or cause service...

The vulnerability of the CMPapp component in CODESYS software products allows a hacker to load arbitrary files into the system.

The vulnerability of the CMPapp component in CODESYS software products is related to the use of files and directories accessible from external parties. Exploiting this vulnerability allows a malicious actor to upload arbitrary files into the system remotely...

CVE-2023-38195

Datalust Seq before 2023.2.9489 allows insertion of sensitive information into an externally accessible file or directory. This is exploitable only when external SQL Server or PostgreSQL metadata storage is used. Exploitation can only occur from a high-privileged user account...

Design/Logic Flaw

Datalust Seq before 2023.2.9489 allows insertion of sensitive information into an externally accessible file or directory. This is exploitable only when external SQL Server or PostgreSQL metadata storage is used. Exploitation can only occur from a high-privileged user account...

CVE-2023-38195

Datalust Seq versions prior to 2023.2.9489 are affected. The issue allows insertion of sensitive information into externally accessible files or directories when external metadata storage (SQL Server or PostgreSQL) is used, and exploitation requires a high-privilege user. Remediation: upgrade to ...

The vulnerability in the /model/__lang_msg.php microprogramming software of the D-LINK DIR-300 router allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /model/langmsg.php microprogrammed software in D-LINK DIR-300 routers is related to incorrect external control of file names or files. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

Mlflow 安全漏洞

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.3.1. An attacker exploiting this vulnerability could access files and directories stored outside of the web root folder...

PT-2023-16758 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: flatpress versions prior to 1.3 Description: The issue concerns external control of file name or path in the GitHub repository flatpressblog/flatpress. Recommendations: For versions prior to 1.3, update to version 1.3 or later to resolve the...

CVE-2023-1070

CVE-2023-1070 affects TeamPass (nilsteampassnet/teampass) prior to version 3.0.0.22. The issue is described as External Control of File Name or Path, enabling an attacker to delete arbitrary files through manipulation of file names/paths. The root cause is a vulnerability in how file names/paths ...

SUSE CVE-2014-3756

The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service hang and resource consumption via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the 1 user or 2 channel name in a Qt dialog, 3...

maps-js-icoads 路径遍历漏洞

maps-js-icoads is a spatio-temporal data visualization of ships and buoys by the individual developer Paul R. Saxman. A path traversal vulnerability exists in maps-js-icoads. An attacker exploiting this vulnerability could access files and directories stored outside of the web root folder...

IBM Spectrum Scale 路径遍历漏洞

IBM Spectrum Scale is a suite of scalable data and file management solutions from International Business Machines IBM based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping customers reduce storage costs while improvin...

UBUNTU-CVE-2022-42706

An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal...