CVE-2026-104706 Mitel MiVoice Office 400 view system files path traversal

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-104706

The Mitel MiVoice Office 400 system is affected by a path traversal vulnerability (CWE-31). This flaw allows an attacker with high privileges to view or download sensitive system files via the portal at https://:8443 specifically through the Administration -> View Logs menu. The vulnerability ...

CVE-2026-104706 Mitel MiVoice Office 400 view system files path traversal

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

Exchange_IOC_Hunter

ExchangeIOCHunter الوصف: ابحث عن مؤشرات الاختراق IOCs في سجلات IIS - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 القطع الأثرية المدعومة: عناوين IP الخاصة بـ C2 المستخدمة في الفحص والاستغلال أسماء الملفات المُلاحظة في محاولات الاستغلال تنفيذ التعليمات البرمجية عن بُعد RCE...

CVE-2026-105636: Server-Side Request Forgery (SSRF)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

PT-2026-104743

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

PT-2026-106083

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description The webhook delivery task in apps/api/plane/bgtasks/webhook task.py uses the requests.post function without setting allow redirects=False and fails to validate redirect targets. While the validate url...

CVE-2026-104806: Path Traversal: 'dir\..\..\filename'

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...

PT-2026-104771

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...

CVE-2026-104706: Path Traversal: 'dir\..\..\filename'

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https:// :8443 via menus Administration - View Logs...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment إثراء سجلات Zeek بمعلومات المضيف لإثراء جميع السجلات التي تحتوي على حقل id، استخدم الوسم ".-all". لإثراء جميع السجلات التي تحتوي على حقل id، والكيانات المعروفة، استخدم الوسم ".-known-all". لإثراء conn.log فقط، استخدم الوسم ".-conn". لإثراء conn.log فقط، والكيانات المعروفة...

GPEWebDefender

GPEWebDefender Un moniteur d'attaques web. Il se place à côté de nginx / Caddy / l'application, suit les logs d'accès et vous prévient lorsqu'un site est sondé ou exploité. Si ce processus meurt, le site continue de servir. Ce n'est pas Wazuh, ni OSSEC, ni un WAF. La commande est gpewebdefender...

CVE-2014-0094

CVE-2014-0094 للتجربة. بالإشارة إلى https://piyolog.hatenadiary.jp/entry/20140417/1397750197، vulhub/java:7u55-jdk tomcat-8.0.5 struts-2.3.16 تمت إعادة إنتاج ذلك. فئة ClassLoader تعمل، لكن السجل الأساسي مشفر بالنسبة المئوية، لذا لا يؤدي إلى RCE تم أيضًا إضافة إصدار Windows ولكنه 7u191.... هذا أيض...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin (versions before 9.2 ) is vulnerable to unauthenticated data disclosure. The root cause is the failure to use a site-specific secret when deriving the storage location for import logs within the uploads directory , combined with a lack of direct acces...

EUVD-2026-91830

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

PT-2026-104522

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.2 Description The plugin fails to use a site-specific secret when determining the storage location for import logs within the uploads directory. Additionally, it does not block direct access to thes...

CVE-2026-80518: Exposure of Sensitive Information to an Unauthorized Actor

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

GHSA-FJ2X-MQQP-3V2W Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values...

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values...