CVE-2024-21549

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This...

CVE-2024-44195

A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files...

PT-2024-53: Reading arbitrary files via API in PT Application Inspector (PT AI)

The vulnerability was identified in PT Application Inspector PT AI, versions 4.4.0 - 4.9.0 inlusevely. The discovered vulnerability allows an attacker with network access to PT AI to read source code files of other users' projects. The vulnerability can be used for privilege escalation...

CVE-2024-21547

CVE-2024-21547 affects the PHP package spatie/browsershot prior to 5.0.2 . The vulnerability is a Directory Traversal flaw caused by URI normalization in the browser where the file:// check can be bypassed using **file:**, allowing an attacker to read arbitrary server files by exploiting normaliz...

CVE-2024-4464

Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors...

CVE-2023-31355

A flaw was found in the AMD firmware. This vulnerability allows a malicious hypervisor to overwrite a guest's UMC seed, potentially enabling the reading of memory from a decommissioned guest via improper restriction of write operations. Mitigation Mitigation for this issue is either not available...

CVE-2024-8058

An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary files on the device due to URL preloading...

Chunghwa Telecom topm-client 安全漏洞

Chunghwa Telecom topm-client is an application from Chunghwa Telecom Taiwan, China. A security vulnerability exists in Chunghwa Telecom topm-client versions 0.3.14 through 0.3.17, which stems from the presence of arbitrary file reading and lack of CSRF protection, as well as a relative path...

PT-2024-17488 · Horner Automation · Cscape

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue occurs in the parsing of CSP files due to the lack of proper validation of user-supplied data. This could allow reading past the end of...

Adobe Acrobat Reader XML External Entity Injection Vulnerability

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. Adobe Acrobat Reader has an XML External Entity Injection vulnerability that originates from a network system or product that is not set up with the correct filters ...

CVE-2024-44246

The issue was addressed with improved routing of Safari-originated requests. This issue is fixed in macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, Safari 18.2, iPadOS 17.7.3. On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address t...

Apple iOS和iPadOS 安全漏洞

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Apple iOS prior to 18.2 and iPadOS prior to 18.2, which stems from the fac...

The vulnerability of Ollama’s system for running and managing large language models, related to out-of-memory reading, allows a perpetrator to trigger a service failure.

The vulnerability of the Ollama system for running and managing large language models is related to memory-bound reading. Exploiting this vulnerability could allow a malicious actor to trigger a service disruption segmentation attack through the use of a specially created file...

PT-2024-31073 · Apple · Ios +4

Name of the Vulnerable Software and Affected Versions: macOS Sequoia versions prior to 15.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Safari versions prior to 18.2 iPadOS versions prior to 17.7.3 Description: The issue was addressed with improved routing of Safari-originated...

CVE-2024-55602

PwnDoc vulnerability CVE-2024-55602 allows an authenticated user who can update and download templates to perform path traversal ("../") in the file extension field, enabling arbitrary file reads on the host. The issue is triggered prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, which i...

CVE-2024-10708

CVE-2024-10708 affects the WordPress System Dashboard plugin prior to version 2.8.15. The vulnerability arises from unvalidated input used in a path (via the sd_viewer action’s filename parameter), enabling authenticated administrators to perform path traversal and read arbitrary server files (e....

Adobe Acrobat Reader 代码问题漏洞

Adobe Acrobat Reader is a PDF viewer from the American company Audobee Adobe. The software is used to print, sign and annotate PDF. Adobe Acrobat Reader has an XML External Entity Injection vulnerability that originates from a network system or product that is not set up with the correct filters ...

PT-2024-39305 · Open Design Alliance · Open Design Alliance Drawings Sdk

Name of the Vulnerable Software and Affected Versions: Open Design Alliance Drawings SDK versions prior to 2025.10 Description: An out-of-bounds write issue was discovered in the Open Design Alliance Drawings SDK. This issue can be triggered by reading a crafted DWF file and missing proper checks...

The vulnerability of Linux operating system’s DRM/AMDGPU cores allows a hacker to trigger a service failure.

The vulnerability of DRM/AMDGPU cores in the Linux operating system is related to errors in reading data beyond the buffer boundaries of memory. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2024-49360 Path traversal in Sandboxie

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user UserA with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders C:\Sandbox\UserB\xxx. An authenticated attack...