PT-2022-10156

Name of the Vulnerable Software and Affected Versions MDT AutoSave versions prior to v6.02.06 Description An issue exists where an attacker can gain knowledge of a session's temporary working folder when the getfile and putfile commands are used. This knowledge can be leveraged to provide a...

CVE-2022-26484

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated administrator to read arbitrary files on the system via...

CVE-2022-26484: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated administrator to read arbitrary files on the system via...

PT-2022-17896

Name of the Vulnerable Software and Affected Versions Veritas InfoScale Operations Manager versions prior to 7.4.2 Patch 600 Veritas InfoScale Operations Manager versions 8.x prior to 8.0.0 Patch 100 Description The web server in Veritas InfoScale Operations Manager fails to sanitize input data f...

CLSA-2021-1638804072 Fix CVE(s): CVE-2021-3426

SECURITY UPDATE: directory traversal - debian/patches/CVE-2021-3426.patch: remove 'getfile' feature from pydoc which can be used to leak sensitive data to unauthorized actors. - CVE-2021-3426...

Python < 3.6.14, 3.7.x < 3.7.11, 3.8.x < 3.8.9, 3.9.x < 3.9.3 Python Issue (bpo-42988) - Mac OS X

Python is prone to an information disclosure vulnerability via pydoc getfile. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MDT AutoSave 信息泄露漏洞

MDT AutoSave is a software application. It provides an automated change management function. An information disclosure vulnerability exists in MDT AutoSave, which stems from the lack of security restrictions on the working directory, and allows an attacker to obtain information about a temporary...

CVE-2021-3426

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to...

Arbitrary File Read

python3.5 is vulnerable to arbitrary file read. Running pydoc -p allows other local users to extract arbitrary files. The /getfile?key=path URL allows to read arbitrary file on the file system...

CVE-2020-9368

The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal...

CVE-2019-1000031

A disk space or quota exhaustion issue exists in article2pdfgetfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visiting PDF generation link but not following the redirect will leave behind a PDF file on disk which will never be deleted by the plug-in...

PT-2019-11530 · WordPress · Article2Pdf

Name of the Vulnerable Software and Affected Versions: article2pdf Wordpress plugin versions 0.24 through 0.27 Description: An Information Disclosure / Data Modification issue exists in the article2pdf getfile.php file. A URL can be constructed to override the PDF file's path, allowing the downlo...

Claymore Dual GPU miner directory traversal vulnerability

Claymore Dual GPU miner is a GPU monitoring software for mining virtual currency computing. A directory traversal vulnerability exists in the remote management interface in Claymore Dual GPU miner version 10.1. A remote attacker could exploit this vulnerability by sending a pathname to minerfile ...

PT-2017-14640

Name of the Vulnerable Software and Affected Versions Claymore Dual GPU miner version 10.1 Description The remote management interface is vulnerable to an authenticated directory traversal issue. This can be exploited by issuing a specially crafted request, allowing a remote attacker to read or...

CVE-2016-7135

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions...

PT-2017-9086

Name of the Vulnerable Software and Affected Versions Plone CMS versions 4.2.x through 4.3.11 Plone CMS versions 5.x through 5.0.6 Description The issue allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to the...

CVE-2016-7135: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions...

CVE-2014-5359: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in SafeNet Authentication Service SAS Outlook Web Access Agent formerly CRYPTOCard before 1.03.30109 allows remote attackers to read arbitrary files via a .. dot dot in the GetFile parameter to owa/owa...

PT-2014-6433

Name of the Vulnerable Software and Affected Versions SafeNet Authentication Service SAS Outlook Web Access Agent formerly CRYPTOCard versions prior to 1.03.30109 Description The issue allows remote attackers to read arbitrary files. This is achieved by using a .. dot dot in the GetFile parameter...

PT-2014-8737

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro plugin versions prior to 1.7.15 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the QUERY STRING in a getfile action to "wp-admin/admin-ajax.php". This is a directory traversal...