SAP BusinessObjects Business Intelligence Platform Information Disclosure Vulnerability

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly and...

SolarWinds Serv-U FTP Server Directory Traversal Vulnerability

Serv-U FTP Server is a File Transfer Protocol FTP server software. A SolarWinds Serv-U FTP Server directory traversal vulnerability can be exploited by an attacker to read arbitrary files by constructing a malicious request...

The vulnerability of the IT service management web component Ivanti Neurons for ITSM allows a malicious actor to read, modify, delete arbitrary files, and cause service failures.

The vulnerability of the IT service management web component Ivanti Neurons for ITSM is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to remotely read, modify, or delete arbitrary files, as well as cause a service failure...

The vulnerability of the Apex One NT RealTime Scan anti-virus software programs Trend Micro Apex One and Apex One as a Service allows attackers to enhance their privileges and execute arbitrary code.

The vulnerability of the Apex One NT RealTime Scan antivirus software programs Trend Micro Apex One and Apex One as a Service is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to enhance their privileges and execute...

PT-2024-24153 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog pro version 2.3 Description: The issue allows for Cross Site Request Forgery CSRF via the twitter.php file, which can be exploited in conjunction with a Cross Site Scripting XSS vulnerability to access administrator information...

The vulnerability of the Damage Cleanup Engine of the Trend Micro Common Client Real-time Scan antivirus software, including the Apex One and Apex One as a Service solutions, allows a malicious actor to trigger a service failure.

The vulnerability of the Damage Cleanup Engine of the Trend Micro Common Client Real-time Scan antivirus software, specifically Apex One and Apex One as a Service, is related to an incorrect definition of the link before accessing a file. Exploiting this vulnerability can allow an attacker to...

GHSA-55F3-3QVG-8PV5 Symlink bypasses filesystem sandbox

Summary If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both oflags::creat and rights::fdwrite. Programs can also crash the runtime by creating a symlink pointing outside with pathsymlink and pathopeni...

The vulnerability of the Redmine DMSF plugin, a project and task management system, arises from incorrect restrictions on the path to the restricted catalog. This allows attackers to gain read, modify, or delete access to files.

The vulnerability of the Redmine DMSF plugin, a project and task management system, is related to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to files...

GHSA-P8H7-C8GW-6X8C LoLLMS Path Traversal vulnerability

A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 9.5.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse...

CVE-2024-4881

A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse...

PYSEC-2024-108

A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse...

PYSEC-2024-108

A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse...

CVE-2024-2928 Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

A Local File Inclusion LFI vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can...

CVE-2024-2928 Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

A Local File Inclusion LFI vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can...

PT-2024-24130 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm versions prior to 1.0.0 Description: The issue is due to improper input validation in several endpoints, allowing an attacker to escalate privileges from a default user role to an admin role, read and delete arbitra...

Files or Directories Accessible to External Parties in ProjectDiscovery

Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files in the directory and subdirectories of where the victim runs interactsh-server via anonymous login...

GO-2024-2642 Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to errors in processing the relative path to the directory, allows a hacker to access arbitrary files from the server.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of TeamCity in JetBrains is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow a malicious actor to read arbitrary files from the server...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

CVE-2024-24919-Exploit Overview This repository contains...

PT-2024-4423

Name of the Vulnerable Software and Affected Versions cri-o versions prior to 1.30.1 cri-o versions prior to 1.29.5 cri-o versions prior to 1.28.7 Description A flaw was found in cri-o, allowing a malicious container to create a symbolic link to arbitrary files on the host via directory traversal...