CVE-2024-39937

supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files...

CVE-2024-39937

CVE-2024-39937 concerns supOS 5.0, where the API endpoint /api/image/download accepts a parameter fileName that can be manipulated with ../ to perform a directory traversal and read arbitrary files. The vulnerability is a path traversal in the image download functionality, leading to potential co...

CVE-2024-39937

supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files...

CVE-2024-29511

Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading and writing of error messages to arbitrary files via OCRLanguage. For example, exploitation can use debugfile /tmp/out and userpatternsfile /etc/passwd...

CVE-2024-29511

Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading and writing of error messages to arbitrary files via OCRLanguage. For example, exploitation can use debugfile /tmp/out and userpatternsfile /etc/passwd...

CVE-2024-5865

Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files reading outside the web publish directory. Versions 23.1-HF7 and on have the patch...

CVE-2024-5865

CVE-2024-5865 affects Delinea Centrify PAS. The issue is a path traversal vulnerability that allows reading arbitrary files outside the web publish directory in Centrify PAS versions before 23.1-HF7; patchs are available in 23.1-HF7 and later. Impact centers on confidentiality (HIGH) with no indi...

CVE-2024-5865 Arbitrary File Reading in Centrify PAS

Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files reading outside the web publish directory. Versions 23.1-HF7 and on have the patch...

CVE-2024-5865 Arbitrary File Reading in Centrify PAS

Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files reading outside the web publish directory. Versions 23.1-HF7 and on have the patch...

CVE-2024-36423 GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/public-chatflows/id endpoint. If the default configuration is used unauthenticated, an attacker may be able to...

CVE-2024-3122 CHANGING Mobile One Time Password - Arbitrary File Reading

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system...

CVE-2024-3122 CHANGING Mobile One Time Password - Arbitrary File Reading

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system...

Flowise Security Vulnerabilities

Flowise is a tool for easily building LLM applications. A security vulnerability exists in Flowise version 1.4.3, which stems from the presence of a reflective cross-site scripting vulnerability that could allow an attacker to read arbitrary files from the server...

PT-2024-37245 · Unknown · Stitionai/Devika

Name of the Vulnerable Software and Affected Versions: stitionai/devika affected versions not specified Description: A path traversal issue in the get-project-files functionality allows attackers to read arbitrary files from the filesystem and cause a Denial of Service DoS. The issue arises due t...

SUSE SLES15: frr / frr-devel / libfrr0 / libfrr_pb0 / libfrrcares0 / etc (SUSE-SU-2024:2245-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2245-1 advisory. - CVE-2023-38406: Fixed nlri length of zero mishandling, aka 'flowspec overflow'. bsc1216900 - CVE-2023-47235: Fixed a crash on...

CVE-2024-39307

Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1...

CVE-2024-39307 Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita

Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1...

CVE-2023-47803

CVE-2023-47803 describes a path traversal vulnerability in Synology Camera firmware. Affected models BC500 and TC500 with firmware versions before 1.0.7-0298 may allow remote attackers to read files containing non-sensitive information via unspecified vectors through the Language Settings functio...

Kakao Piccoma Security Breach

Kakao Piccoma is a mobile application for reading manga by the Japanese company Kakao Piccoma. A security vulnerability exists in Kakao Piccoma versions prior to 6.20.0, which stems from the use of hard-coded API keys...

CVE-2023-49793

CVE-2023-49793 describes a path traversal in CodeChecker server via the massStoreRun endpoint (CodeCheckerService). ZIPs uploaded to CodeChecker store are not sanitized, allowing reading files from the server with the same permissions as the CodeChecker server. Attack requires a CodeChecker user ...