CVE-2025-1686

Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files...

CVE-2024-54957

Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an attacker to craft a malicious link that redirects users to an arbitrary external URL without their consent...

CVE-2024-54957

Nagios XI 2024R1.2.2 is affected by an open redirect on the Tools page. The flaw allows a user with read‑only permissions to craft a link that redirects to an arbitrary external URL without user consent. Root cause not explicitly detailed in the provided documents beyond the open redirect behavio...

PT-2025-8914

Name of the Vulnerable Software and Affected Versions io.pebbletemplates:pebble versions affected versions not specified Description The issue allows an attacker to control file names or paths via the include tag, potentially accessing sensitive local files like /etc/passwd or /proc/1/environ by...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI version 2024R1.2.2, which stems from an open redirect on the...

AZL-68624 CVE-2022-49504 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Inhibit aborts if external loopback plug is inserted After running a short external loopback test, when the external loopback is removed and a normal cable inserted that is directly connected to a target device, the...

UBUNTU-CVE-2022-49504

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Inhibit aborts if external loopback plug is inserted After running a short external loopback test, when the external loopback is removed and a normal cable inserted that is directly connected to a target device, the...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the scsi lpfc module that can cause a system crash after an external loopback test...

Amazon Linux 2 : thunderbird (ALAS-2025-2765)

The version of thunderbird installed on the remote host is prior to 128.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2765 advisory. A permission leak could have occurred from a trusted site to an untrusted site via embed or object elements. This...

The vulnerability of software solutions that support the process of closing, consolidating, and generating reports for IBM Cognos Controller and IBM Controller lies in the improper restriction on XML links to external objects. This allows attackers to carry out XXE attacks.

The vulnerability of software solutions that support the process of closing, consolidating, and generating reports for IBM Cognos Controller and IBM Controller is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow attackers to perform XXE...

Amazon Linux 2 : firefox (ALASFIREFOX-2025-034)

The version of firefox installed on the remote host is prior to 128.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2025-034 advisory. The origin of an external protocol handler prompt could have been obscured using a data: URL within an iframe. Thi...

External Control of File Name or Path

Overview io.pebbletemplates:pebble is a java templating engine inspired by Twig. Affected versions of this package are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates...

Files or Directories Accessible to External Parties

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties due to insufficient sanitizing in the TeX notation filter. Note: This is only exploitable on sites where pdfTeX is available Remediation Upgrade...

CVE-2024-12917

Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security Levels, Authentication Abuse. This issue affects Health4All: before 10.01.2025...

CVE-2024-12917 Improper Access Control in Agito Computer's Health4All

Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security Levels, Authentication Abuse. This issue affects Health4All: before 10.01.2025...

Agito Computer Health4All 安全漏洞

Agito Computer Health4All is a health management program from Agito Computer. A security vulnerability exists in Agito Computer Health4All versions prior to 10.01.2025 that stems from improperly restricting the accessibility of a file or directory to external parties, resulting in improperly...

CVE-2024-55156

An XML External Entity XXE vulnerability in the deserializeArgs method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message...

PT-2025-7694 · Unknown · Divi Donation Modules

Name of the Vulnerable Software and Affected Versions: Give – Divi Donation Modules versions prior to 2.0.0 Description: The issue allows the retrieval of embedded sensitive data due to the insertion of sensitive information into externally-accessible files or directories. Recommendations: For...

CVE-2024-49781

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the deserialize method, when handling untrusted XML data, which may contain external entity references. Details XXE Injection is a type of attack against an application that parses XML input. XML is...