PT-2023-5124 · Dover Fueling Solutions · Maglink Lx Web Console Configuration

Name of the Vulnerable Software and Affected Versions: Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1 through 3.3 Description: The issue is related to incorrect restriction of directory path names with limited access. This could allow a remote attacker to access files...

Multiple vulnerabilities in CGIs of PMailServer and PMailServer2

Overview CGIs included with PMailServer and PMailServer2 provided by A.K.I Software contain multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2023-39223 Insufficient verification vulnerability in Broadcast Mail CGI pmc.exe CWE-434 - CVE-2023-39933...

The vulnerability of the DevTools set of tools for web development in the Google Chrome browser allows a hacker to gain access to and modify files.

The vulnerability of the DevTools set of tools for web development in the Google Chrome browser is related to an incorrect path limitation for accessing restricted directories. Exploiting this vulnerability could allow a malicious actor to remotely access and modify files by downloading a special...

CVE-2023-1437

All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute...

PT-2023-4580 · Iagona · Iagona Scrutisweb

Name of the Vulnerable Software and Affected Versions: Iagona ScrutisWeb versions 2.1.37 and prior Description: The issue exists due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow a remote attacker to gain direct access to any...

PT-2023-4939 · Advantech · Webaccess/Scada

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess/SCADA versions prior to 9.1.4 Description: The issue is related to the use of untrusted pointers in the software. Specifically, the RPC arguments sent by the client could contain raw memory pointers that the server uses...

OESA-2023-1419 pki-core security update

Dogtag PKI is a designed enterprise software system manage enterprise Public Key Infrastructure deployments. Security Fixes: Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content o...

PT-2023-21975 · Frauscher Sensortechnik Gmbh · Fds001

Name of the Vulnerable Software and Affected Versions: Frauscher Sensortechnik GmbH FDS001 for FAdC/FAdCi versions 1.3.3 and earlier Description: The issue allows a remote attacker to read all files on the filesystem of the FDS001 device through a path traversal vulnerability of the web interface...

PT-2023-25716 · Fides · Fides

Name of the Vulnerable Software and Affected Versions: Fides versions prior to 2.15.1 Description: A path traversal vulnerability affects Fides, allowing remote attackers to access arbitrary files on the Fides webserver container's filesystem. If the Fides webserver API is deployed behind a rever...

PT-2023-24261 · Gira Giersiepen · Gira Knx/Ip-Router

Name of the Vulnerable Software and Affected Versions: Gira Giersiepen Gira KNX/IP-Router versions 3.1.3683.0 through 3.3.8.0 Description: The web interface of the affected device allows a remote attacker to read sensitive files via directory-traversal sequences in the URL. This issue enables...

Starlette vulnerable to directory traversal

Overview Starlette provided by Encode contains a directory traversal vulnerability CWE-22. Masashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Under certain conditions, a remote...

Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.3.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

GHSA-83FM-W79M-64R5 Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.3.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

CVE-2023-29887

A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter...

CVE-2023-0835 markdown-pdf 11.0.0 - Local File Read via Server Side XSS

markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user...

CVE-2022-36982

This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandle...

PT-2023-3011 · WordPress · Gravity Forms

Name of the Vulnerable Software and Affected Versions: Gravity Forms versions n/a through 2.7.3 Description: The issue is related to the deserialization of untrusted data in Gravity Forms, which can be exploited by a remote attacker to gain read, modify, or delete access to files or execute...

mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

GHSA-XG73-94FP-G449 mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

IBM Security Guardium Key Lifecycle Manager 路径遍历漏洞

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A path traversal vulnerability exists in IBM Security...