16540 matches found
CVE-2023-0835 markdown-pdf 11.0.0 - Local File Read via Server Side XSS
markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user...
CVE-2023-25356
CoreDial sipXcom up to and including 21.04 is vulnerable to Improper Neutralization of Argument Delimiters in a Command. XMPP users are able to inject arbitrary arguments into a system command, which can be used to read files from, and write files to, the sipXcom server. This can also be leverage...
PT-2023-16559 · Unknown · Markdown-Pdf
Name of the Vulnerable Software and Affected Versions: markdown-pdf version 11.0.0 Description: The issue allows an external attacker to remotely obtain arbitrary local files due to the application's failure to validate the Markdown content entered by the user. Recommendations: For markdown-pdf...
PT-2023-2128
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 112.0.5615.49 Description The issue is related to an inappropriate implementation in Google Chrome extensions, allowing an attacker to bypass file access restrictions. This can be achieved by convincing a user t...
CVE-2023-1813: Undefined Security Weakness
Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. Chromium security severity: Medium...
PT-2023-21333 · Wondershare · Wondershare Anireel
Name of the Vulnerable Software and Affected Versions: Wondershare Anireel version 1.5.4 Description: An issue in Wondershare Anireel allows a remote attacker to execute arbitrary commands via the anireel setup full9589.exe file. Recommendations: For Wondershare Anireel version 1.5.4, consider...
VulnCheck KEV: CVE-2021-27876
Veritas Backup Exec BE Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine...
go-fastdfs 代码问题漏洞
go-fastdfs is a simple distributed file system private cloud storage, with no center, high performance, high reliability, maintenance-free and other advantages, support for intermittent uploads, chunked uploads, small file merging, auto-synchronization, auto-repair. sjqzhang go-fastdfs version...
Exploit for Inadequate Encryption Strength in Argussurveillance Dvr
Argus Surveillance DVR 4.0 - Weak Password Encryption CVE-2...
CVE-2023-28647
Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain...
CVE-2023-28732 Missing access control affecting the AcyMailing plugin for Joomla
Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plug...
CVE-2022-36982
This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandle...
Security Bulletin: Multiple vulnerabilities in IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products
Summary Vulnerabilities exist in IBM SAN Volume Controller, IBM Storwize V7000, V5000, V3700 and V3500, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud and IBM FlashSystem V9000. Vulnerability Details CVEID: CVE-2018-1433 DESCRIPTION: IBM SAN Volume Controller, IBM...
PT-2023-17163 · Xunruicms · Xunruicms
Name of the Vulnerable Software and Affected Versions: Xunrui CMS version 4.61 Description: A problematic issue has been found in the processing of the file /dayrui/My/View/main.html, leading to information disclosure. The attack may be initiated remotely. Recommendations: For Xunrui CMS version...
PT-2023-2180
Name of the Vulnerable Software and Affected Versions NGINX Agent versions 2.0 through 2.23.2 Description The issue is related to insufficient protection of registration data, which may allow an attacker to gain access to private keys. This can occur when an authenticated attacker with local acce...
CVE-2023-26344 ZDI-CAN-19467: Adobe Dimension USD File Access of Uninitialized Pointer Information Disclosure Vulnerability
Adobe Dimension versions 3.4.7 and earlier is affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in...
The vulnerability of the _is_safe() function in the Perl programming language allows a perpetrator to compromise data integrity.
The vulnerability of the issafe function in the Perl programming language is related to the incorrect definition of symbolic references before accessing a file. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...
Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF)
Exploit Title: Label Studio 1.5.0 - Authenticated Server Side Request Forgery SSRF Google Dork: intitle:"Label Studio" intext:"Sign Up" intext:"Welcome to Label Studio Community Edition" Date: 2022-10-03 Exploit Author: @DeveloperNinja, [email protected] Vendor Homepage:...
