CVE-2023-41113

An issue was discovered in EnterpriseDB Postgres Advanced Server EPAS before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It allows an authenticated user to to obtain information about whether certain files exist on disk, what errors if any occ...

PT-2023-31040 · Sap · Sap Master Data Governance

Name of the Vulnerable Software and Affected Versions: SAP Master Data Governance affected versions not specified Description: The issue allows an attacker to exploit insufficient validation of path information provided by users. This can lead to characters representing 'traverse to parent...

The vulnerability of the Apache Struts software platform, related to the use of files and directories accessible from external parties, allows a hacker to execute arbitrary code.

The vulnerability of the Apache Struts software platform is related to the use of files and directories accessible from external parties due to incorrect restrictions on the path to the restricted directory during file loading. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2023-47440

Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine...

etcd Security Vulnerabilities

etcd is a key-value storage system for distributed systems written in the Go language. A security vulnerability exists in version 87ae63d75260 of etcd-browser, which stems from an issue found in server.js, where a remote server port specified during installation can be traversed by sending a GET...

CVE-2023-49248

Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access...

CVE-2023-49248

CVE-2023-49248 affects Huawei HarmonyOS, specifically the Settings application. The vulnerability is described as a file override access issue that can lead to unauthorized file access. Connected documents corroborate the issue title and impact but do not provide concrete remediation steps or add...

CVE-2023-49108

Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 excluding Ver.6.1.1.3a. If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges...

Internet Bug Bounty: ASAR Integrity bypass via filetype confusion

A vulnerability was discovered in Electron that allowed bypassing ASAR integrity checks via filetype confusion. Maliciously crafted directories could trick apps into loading non-validated code. This impacted apps with certain fuses enabled on macOS that relied on filesystem protections. The issue...

RakRak Document Plus vulnerable to path traversal

Overview RakRak Document Plus provided by Sumitomo Electric Information Systems Co., Ltd. contains a path traversal vulnerability CWE-22. Asato Masamu of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

VulnCheck KEV: CVE-2021-43798

Grafana contains a path traversal vulnerability that could allow access to local files...

PT-2023-32679 · Thecosy · Thecosy Icecms

Name of the Vulnerable Software and Affected Versions: Thecosy IceCMS version 2.0.1 Description: A vulnerability was found in the User Comment Handler component, affecting unknown code of the file /planet. The manipulation leads to cross site scripting. The attack can be initiated remotely...

CVE-2023-6352

The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate...

CVE-2023-6343

The CVE describes a vulnerability in Tyler Technologies Court Case Management Plus related to the Aquaforest TIFF Server used for handling TIFF files. Affected component: Aquaforest TIFF Server (integrated via Tyler’s court management solution). Vulnerability occurs in TIFF Server features access...

Multiple Vulnerabilities Affecting Web-Based Court Case and Document Management Systems

CISA has assisted a researcher with coordinating the disclosure of multiple researcher-discovered vulnerabilities affecting web-based case and document management systems used by multiple state, county, and municipal courts. Affected systems include products from Tyler Technologies and Catalis an...

PT-2023-32621 · Microsoft +1 · Windows +2

Name of the Vulnerable Software and Affected Versions: Aquaforest TIFF Server affected versions not specified Description: The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microso...

Aquaforest TIFF Server Path Traversal Vulnerability

Aquaforest TIFF Server is a TIFF Tagged Image File Format server from Aquaforest, UK. A security vulnerability exists in Aquaforest TIFF Server that stems from a default configuration that allows access to arbitrary file paths...

VulnCheck KEV: CVE-2021-33564

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features...

Dreamer CMS Security Vulnerability

Dreamer CMS is a Dreamer Content Management System by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS versions prior to 4.0.1, which stems from a directory traversal vulnerability. An attacker can exploit this vulnerability to modify template files or...

CVE-2023-5885

CVE-2023-5885 affects Franklin Electric Fueling Systems Colibri (discontinued Colibri product). The vulnerability is a Path Traversal (CWE-35) that allows a remote attacker to access files on the system, including files containing login credentials for other users. Affected scope: Colibri firmwar...