PT-2023-33042 · Unknown · Xmlrpc Client

Name of the Vulnerable Software and Affected Versions: xmlrpc Client affected versions not specified Description: The issue allows an attacker to force the client to access local files or connect to undesired URLs instead of the intended target server's URL. This is possible by abusing the $metho...

BlackBox 路径遍历漏洞

BlackBox is an application. BlackBox BlackBox, a virtual engine, supports 5.0 to 12.0, can clone and run virtual apps on Android, has the ability to run without installation and has integrated Xposed framework. BlackBox can take control of the virtual apps being run and do whatever you want. A pa...

media_upload 路径遍历漏洞

mediaupload is a Fluid widget provided for mass uploading media on the front-end using HTML5 technology. A path traversal vulnerability exists in mediaupload. An attacker could use this vulnerability to access files and directories stored outside of the web root folder...

PT-2023-1058 · Siemens · Sinec Ins

Name of the Vulnerable Software and Affected Versions: SINEC INS versions prior to V1.0 SP2 Update 1 Description: A vulnerability has been identified that allows an authenticated remote attacker with access to the Web Based Management 443/tcp to potentially read and write arbitrary files from and...

PT-2023-9752

Name of the Vulnerable Software and Affected Versions Mozilla Convict versions prior to 6.2.4 Description The issue is related to improperly controlled modification of object prototype attributes, also known as "prototype pollution." This allows an attacker to inject attributes that are used in...

CVE-2023-21760: Improper Link Resolution Before File Access

Windows Print Spooler Elevation of Privilege Vulnerability...

CVE-2023-22473

Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target's device. There are currently no...

CVE-2023-22473: Improper Access Control

Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target's device. There are currently no...

maps-js-icoads 路径遍历漏洞

maps-js-icoads is a spatio-temporal data visualization of ships and buoys by the individual developer Paul R. Saxman. A path traversal vulnerability exists in maps-js-icoads. An attacker exploiting this vulnerability could access files and directories stored outside of the web root folder...

Path Traversal

httpster is vulnerable to path traversal. The vulnerability exists in server.js because it accesses files and directories that are stored outside the intended folder, which allows an attacker to access arbitrary files and directories stored...

CVE-2022-43932

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in CGI component in Synology Router Manager SRM before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2022-45052

A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.type.php endpoint, external users are capable of accessing files on the server...

Axiell Iguana CMS 安全漏洞

Axiell Iguana CMS is a control-based platform from Axiell Inc. for personalizing and communicating with customers. Axiell Iguana CMS has a security vulnerability that originates from an input error in the url parameter on imageProxy.type.php. An attacker exploiting the vulnerability is able to...

CVE-2022-46305 ChangingTec ServiSign - Path Traversal

ChangingTec ServiSign component has a path traversal vulnerability. An unauthenticated LAN attacker can exploit this vulnerability to bypass authentication and access arbitrary system files...

PT-2023-13640 · Unknown · Gravitee Api Management

Name of the Vulnerable Software and Affected Versions: Gravitee API Management versions prior to 3.15.13 Description: The issue allows path traversal through HTML injection, potentially enabling anonymous users to read arbitrary files. This is achieved by combining HTML injection with path...

CVE-2022-4236 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...

CVE-2022-4236 Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...

CVE-2022-4140 Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...

CVE-2022-4140 Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server...

PT-2023-14110 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.5 Description: The issue concerns the Welcart e-Commerce WordPress plugin, which does not validate user input before using it to output the content of a file via an AJAX action availab...