CVE-2023-6020

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication...

CVE-2023-6021

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

Authentication flaw

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6023

An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifactpath URL parameter...

Code injection

An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifactpath URL parameter...

CVE-2023-6021 Ray Log File Local File Include

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6021

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6021

Technical details for CVE-2023-6021 are not publicly available in the provided documents. Monitor for updates from official advisories or vendor notices to confirm affected components, impact, and remediation.

CVE-2023-6038

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...

CVE-2023-6023 ModelDB Local File Include

An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifactpath URL parameter...

CVE-2023-6023

An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifactpath URL parameter...

CVE-2023-6023

VertaAI ModelDB is affected by CVE-2023-6023 (Path Traversal/LFI). The Nuclei template identifies the vulnerable endpoint as /api/v1/artifact/getArtifact?artifact_path= with no validation or sanitization of artifact_path, enabling an attacker to read arbitrary files from the server filesystem. Im...

CVE-2023-6020: Missing Authorization

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication...

CVE-2023-6021: Path Traversal: '\..\filename'

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6023: Path Traversal: '\..\filename'

An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifactpath URL parameter...

Webpushr < 4.35.0 - LFI via CSRF

Description The plugin does not have CSRF check in its wppsavesettings function, and does not validate the menu parameter, allowing attackers to make logged in users admins perform LFI attacks via CSRF...

PT-2023-25111

Name of the Vulnerable Software and Affected Versions Webpushr Web Push Notifications plugin versions = 4.34.0 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability that can lead to Local File Inclusion LFI. This means an attacker could potentially trick a user into...

CVE-2023-5550 Moodle: rce due to lfi risk in some misconfigured shared hosting environments

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution...

Remote file inclusion

A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local file inclusion LFI via the /tools/webinterface/index.php?page parameter by sending a GET request. This vulnerability could lead to the...

CVE-2023-4591

CVE-2023-4591 affects WPN-XM Serverstack 0.8.6. A local file inclusion flaw in the /tools/webinterface/index.php?page parameter allows an unauthenticated user to load server PHP files, potentially enabling a webshell. The issue is rooted in LFI handling and is described across multiple sources as...