CVE-2024-12058

External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files...

CVE-2024-12058

External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files...

PT-2025-1074

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Expedition affected versions not specified Description The issue is related to an arbitrary file deletion vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to delete...

ZOO-Project 代码问题漏洞

ZOO-Project is an open source processing platform from ZOO-Project Open Source. A code issue vulnerability exists in ZOO-Project that stems from not performing input validation and a path traversal vulnerability that allows an attacker to take full control of the files returned in a response...

GHSA-PR45-CG4X-FF4M ggit is vulnerable to Arbitrary Argument Injection via the clone() API

All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line...

PT-2024-19805 · Unknown · Controller 6000 +1

Name of the Vulnerable Software and Affected Versions: Controller 6000 and Controller 7000 versions 8.60 and prior Controller 6000 and Controller 7000 versions 8.70 prior to vCR8.70.240520a Controller 6000 and Controller 7000 versions 8.80 prior to vCR8.80.240520a Controller 6000 and Controller...

CVE-2024-25965

Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service...

CVE-2024-31214

Summary: CVE-2024-31214 affects Traccar 5.1–5.12, where the device image upload API allows arbitrary file uploads with attacker-controlled content, directory, extension, and partial filename. This can enable remote code execution or other impacts (XSS, DOS) and is worsened by default self-registr...

BIT-TOMCAT-2020-9484

When using Apache Tomcat versions 9.0.0 through 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a an attacker is able to control the contents and name of a file on the server; and b the server is configured to use the PersistenceManager with a FileStore; and c the PersistenceManager is configured...

PT-2024-2128 · Ibm · Ibm Watson Cp4D Data Stores

Name of the Vulnerable Software and Affected Versions: IBM Watson CP4D Data Stores versions 4.6.0 through 4.6.3 Description: The issue is related to incorrect external control of a file name or path, which could allow a user with physical access and specific knowledge of the system to modify file...

CVE-2023-49346

Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...

CVE-2023-49343

Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...

CVE-2023-49342

Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...

PT-2023-7417 · Mitsubishi · Gx Works3 +4

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric FA Engineering Software Products affected versions not specified MELSOFT iQ AppPortal affected versions not specified MELSOFT Navigator affected versions not specified Motion Control Setting affected versions not specified...

CVE-2023-41718

When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a specific file...

CVE-2023-41718

When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a specific file...

SUSE-SU-2023:4119-1 Security update for slurm

This update for slurm fixes the following issues: - CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. bsc1216207...

SUSE-SU-2023:4113-1 Security update for slurm

This update for slurm fixes the following issues: - CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. bsc1216207...

CVE-2023-41717

Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restrictions...

The vulnerability in the /model/__lang_msg.php microprogramming software of the D-LINK DIR-300 router allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /model/langmsg.php microprogrammed software in D-LINK DIR-300 routers is related to incorrect external control of file names or files. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...