CVE-2025-2905

Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity XXE resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: Read sensitive files from the...

CVE-2025-20978

Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege...

CVE-2025-20949

Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Members...

CVE-2025-20978

Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege...

CVE-2025-20978

Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege...

CVE-2025-20967

Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows attackers to read and write arbitrary file with the privilege of Samsung Gallery...

CVE-2025-20967

The CVE-2025-20967 case concerns Samsung Gallery. Affected versions expose improper access control in Global Android 13 (pre-14.5.10.3), China Android 13 (pre-14.5.09.3), and Android 14 (pre-15.5.04.5), allowing an attacker to read and write arbitrary files with Samsung Gallery privileges. The un...

CVE-2025-20961

Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025 Release 1 allows local privileged attackers to access files with system privilege...

CVE-2025-20949

Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Members...

CVE-2025-20949

Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Samsung Members...

CVE-2025-20949

The CVE-2025-20949 entry concerns Samsung Members with a path traversal vulnerability affecting versions prior to 5.0.00.11. Reported data describe an issue where an attacker could read and write arbitrary files using the privilege of Samsung Members, due to improper filtering of path elements. S...

PT-2025-20119 · Eventon · Eventon

Name of the Vulnerable Software and Affected Versions: EventON versions n/a through 2.4.1 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This is a...

PT-2025-20266 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: The issue is due to insufficient input validation in the web-based management interface, allowing an authenticated, low-privileged, remote attacker to perform an injection...

PT-2025-20063 · Penup · Penup

Name of the Vulnerable Software and Affected Versions: PENUP versions prior to 3.9.19.32 Description: The issue is related to improper access control, allowing local attackers to access files with PENUP privilege. Recommendations: For versions prior to 3.9.19.32, update to version 3.9.19.32 or...

Configure Audit Rules for File Access Failures

System calls, such as open, truncate, ftruncate, create and openat, are audited and monitored. If the -EACCES or -EPERM error is returned, you lack the permission to access the files. In this case, audit logs need to be recorded. File access failures due to a lack of proper permissions are common...

PT-2025-20037 · Samsung · Samsung Members

Name of the Vulnerable Software and Affected Versions: Samsung Members versions prior to 5.0.00.11 Description: The issue allows attackers to read and write arbitrary files with the privilege of Samsung Members due to a path traversal vulnerability. Recommendations: For versions prior to 5.0.00.1...

CVE-2025-47423

Personal Weather Station Dashboard 12lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/test.php, as demonstrated by reading the server's private SSL key in cleartext...

CVE-2024-49835

CVE-2024-49835 is described as memory corruption while reading a secure file in Qualcomm closed‑source components. The CVSS v3.1 vector indicates a local, low‑privilege, low‑complexity attacker could trigger a high‑impact issue (C: High; I: High; A: High) with no user interaction. Several connect...

CVE-2024-49835 Out-of-bounds Write in SPS Applications

Memory corruption while reading secure file...

CVE-2025-4248

A vulnerability has been found in SourceCodester Simple To-Do List System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /completetask.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The...