CVE-2021-40668

The Android application HTTP File Server Version 1.4.1 by 'slowscript' is affected by a path traversal vulnerability that permits arbitrary directory listing, file read, and file write...

Vite directory traversal vulnerability

Vite is a new front-end builder that significantly improves the front-end development experience, and is vulnerable to directory traversal, which could be exploited to access local file systems...

CVE-2022-31496

LibreHealth EHR Base 2.0.0 allows incorrect interface/super/managesitefiles.php access...

CVE-2022-1993

Path Traversal in GitHub repository gogs/gogs prior to 0.12.9...

CVE-2022-30747

PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...

CVE-2022-30745

Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share...

CVE-2022-30747

PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...

CVE-2022-30731

Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My Files application...

Improper access control

Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My Files application...

CVE-2022-30747: Incorrect Default Permissions

PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...

PT-2022-20269 · M Files · My Files

Name of the Vulnerable Software and Affected Versions: My Files versions prior to 13.1.00.193 Description: The issue is related to improper access control in the My Files application, allowing attackers to access arbitrary private files. Recommendations: For versions prior to 13.1.00.193, update ...

PT-2022-20286

Name of the Vulnerable Software and Affected Versions Smart Things versions prior to 1.7.85.25 Description The issue allows local attackers to access files without permission via implicit Intent. This is due to a PendingIntent hijacking vulnerability. Recommendations For versions prior to...

CVE-2022-24840

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the "AWSLOCATION" setting was set, traversal was limited to that location only. The issue was...

CVE-2022-24840: Improper Limitation of a Pathname to a Restricted Directory

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the AWSLOCATION setting was set, traversal was limited to that location only. The issue was...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, a U.S. company. Google Android is vulnerable to an information disclosure vulnerability caused by the presence of an obfuscated agent in the uploadFile function in FileUploadServiceImpl.java that leads to incorrect file...

The vulnerability of the TrueConf Server software lies in the possibility of bypassing the path in the script /handlers/get-img-file.php, allowing an attacker to access arbitrary files.

The vulnerability of the TrueConf Server software is related to the possibility of bypassing the path in the script /handlers/get-img-file.php. Exploiting this vulnerability allows a malicious actor to gain access to arbitrary files...

Fedora: Security Advisory for fapolicyd (FEDORA-2022-47a86f6258)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-32271

In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary loca...

[SECURITY] Fedora 35 Update: fapolicyd-1.1.2-1.fc35

Fapolicyd File Access Policy Daemon implements application whitelisting to decide file access rights. Applications that are known via a reputation source are allowed access while unknown applications are not. The daemon makes use of the kernel's fanotify interface to determine file access rights...

[SECURITY] Fedora 36 Update: fapolicyd-1.1.2-1.fc36

Fapolicyd File Access Policy Daemon implements application whitelisting to decide file access rights. Applications that are known via a reputation source are allowed access while unknown applications are not. The daemon makes use of the kernel's fanotify interface to determine file access rights...