Android Mercury Browser Intent URI Scheme And Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Mercury Browser Intent URI Scheme and Directory Traversal Vulnerability', 'Description' = %q This module exploits an unsafe intent URI...

Firefox PDF.js Browser File Theft

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Firefox PDF.js Browser File Theft', 'Description' = %q This module abuses an XSS vulnerability in versions prior to Firefox 39.0.3, Firefox ESR...

Tomcat UTF-8 Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Tomcat UTF-8 Directory Traversal Vulnerability', 'Description' = %q This module tests whether a directory traversal vulnerability is present in...

CVE-2024-7608

An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal...

CVE-2024-7608

An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal...

CVE-2024-7608

CVE-2024-7608 affects Trellix NX, EX, FX, AX, IVX, and CMS. An authenticated user can exploit a path-traversal in the product’s download artifact flow to read restricted files on the server. Documented impact is file disclosure of sensitive server content; no public fix/version information is pro...

CVE-2024-7608

An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal...

PT-2024-38449 · Trellix · Trellix Fx +5

Name of the Vulnerable Software and Affected Versions: Trellix NX, EX, FX, AX, IVX, and CMS affected versions not specified Description: An authenticated user can access restricted files from Trellix products using path traversal for the URL of network anomaly download artifact. This issue allows...

CVE-2024-7729 CAYIN Technology CMS - Sensitive File Download

The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files...

CVE-2024-41905

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V2.0. The affected application do not have access control for accessing the files. This could allow an authenticated attacker with low privilege's to get access to sensitive information...

CVE-2024-6760

CVE-2024-6760 describes a logic bug in FreeBSD's ktrace which disables kernel tracing for setuid programs. The flaw allows unprivileged users to trace and inspect the behavior of setuid binaries, potentially reading files they normally should not access (e.g., the local password database). Connec...

DzzOffice 安全漏洞

DzzOffice is a platform from Big Desk DzzOffice that provides online collaborative office suite functionality. It provides online documents, forms, webstores, presentations and other features. A security vulnerability exists in DzzOffice version 2.02.1, which stems from vulnerability to directory...

Devika 信息泄露漏洞

Devika is an advanced AI software engineer open-sourced by stition. It can understand advanced human commands, break them down into steps, study the relevant information, and write code to achieve a given goal. Devika suffers from an information disclosure vulnerability that stems from being...

PT-2024-27998 · Unknown · Matrix Tafnit

Name of the Vulnerable Software and Affected Versions: Matrix Tafnit version 8 Description: The issue concerns files or directories being accessible to external parties, which is classified as CWE-552. Recommendations: For Matrix Tafnit version 8, consider restricting access to sensitive files an...

PT-2024-28272 · Studio 42 · Elfinder

Name of the Vulnerable Software and Affected Versions: Studio 42 elFinder version 2.1.64 Description: The issue allows an arbitrary attacker to expose secrets and perform remote code execution RCE by copying files with unauthorized extensions between server directories. This is due to incorrect...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-21527

Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-si...