CVE-2025-46619

A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow...

CVE-2025-46619

CVE-2025-46619 affects Couchbase Server: versions prior to 7.6.4 are vulnerable; Windows specifically affected up to 7.2.7. The issue could allow unauthorized access to sensitive files (e.g., /etc/passwd, /etc/shadow) depending on privilege level. Fixed in v7.6.4 for general use and in v7.2.7 for...

Couchbase Server 安全漏洞

Couchbase Server is a distributed open source NoSQL non-relational database from Couchbase, Inc. in the United States. It supports features such as data querying, full-text search and active global replication. A security vulnerability exists in Couchbase Server versions prior to 7.6.4, which ste...

PT-2025-18309 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions prior to 7.6.4 Couchbase Server version 7.2.7 and earlier for Windows Description: A security issue has been discovered that could allow unauthorized access to sensitive files, potentially granting access to files su...

CVE-2025-46619

A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow...

CVE-2025-46619

A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow...

NetScout nGeniusONE 安全漏洞

NetScout nGeniusONE is a centralized application management and network performance solution from NetScout, Inc. A security vulnerability exists in NetScout nGeniusONE versions prior to 6.4.0 b2350 that originates from accessing sensitive files without proper authentication...

Directory Traversal

Overview github.com/grafana/grafana/pkg/api/pluginproxy is an open-source platform for monitoring and observability. Affected versions of this package are vulnerable to Directory Traversal. An attacker can gain unauthorized read-only access to sensitive endpoints by appending an extra slash to th...

PT-2025-17446 · Unknown · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal versions 2.9.0.1 and earlier Description: The issue allows an attacker to perform a Directory Traversal attack via the BetterImageGallery API Controller, specifically through the ImageHandler action. This can lead to unauthorized...

CVE-2025-43928

The CVE-2025-43928 entry concerns Infodraw Media Relay Service (MRS) v7.1.0.0. The MRS web server (port 12654) exposes a path traversal in the username field, enabling reading arbitrary files. Reading ServerParameters.xml could disclose administrator credentials (cleartext or MD5 hashed). Affecte...

CVE-2025-31497

TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service contains a critical XML External Entity XXE Injection vulnerability in its document conversion functionality. The service processes XML...

Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted

Summary Software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a...

PT-2025-16317 · Unknown · Notfound Coming Soon

Name of the Vulnerable Software and Affected Versions: NotFound Coming Soon, Maintenance Mode versions n/a through 1.1.1 Description: The issue is related to Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This...

Authorization Bypass Through User-Controlled Key

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key that allows an attacker to enumerate sensitive files by manipulating request...

Important: tomcat9

Issue Overview: Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from...

Exploit for Path Traversal in Splunk

CVE-2024-36991-Tool This binary POC autom...

Exploit for Path Traversal in Splunk

Splunk Path Traversal Exploit CVE-2024-36991 Descript...

Access control error vulnerability exists in Vite (CNVD-2025-05817)

Vite is Vite open source a new front-end building tools . Vite has an access control error vulnerability that can be exploited by an attacker to bypass the development server's protection mechanism and illegally access sensitive files outside the project root directory...

AgentScope path traversal vulnerability

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling t...

Directory Traversal

Overview InvokeAI is an An implementation of Stable Diffusion which provides various new features and options to aid the image generation process Affected versions of this package are vulnerable to Directory Traversal through the web API POST /api/v1/images/delete. An attacker can delete arbitrar...