Xxe

XML External Entity injection in apache ambari versions = 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The...

LG webOS Security Vulnerability

LG webOS is a Linux kernel-based smart TV operating system from South Korea's LG. A security vulnerability exists in LG webOS. An attacker could exploit the vulnerability to read arbitrary files on the server running the application...

CVE-2023-4550

Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server on which it is hosted. Thi...

CVE-2024-0697

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.3 via the nodeid parameter in the backuplygetjstree function. This makes it possible for attackers with administrator privileges or higher to read...

PT-2024-40201 · Streamlit · Streamlit

Name of the Vulnerable Software and Affected Versions: Streamlit versions prior to 1.30.0 Streamlit versions prior to 1.11.1 are also affected, but the issue was partially addressed in version 1.11.1 Description: The issue allows for directory traversal attacks, potentially exposing certain files...

CVE-2023-50731 MindsDB has arbitrary file write in file.py

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which...

GHSA-QG8P-32GR-GH6X MLflow Local File Disclosure Vulnerability

This vulnerability enables malicious users to read sensitive files on the server...

External Control of File Name or Path in h2oai/h2o-3

Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting ...

h2o Security Vulnerabilities

h2o is a new generation of HTTP server. Not only is it very fast compared to older generation HTTP servers, but it also provides faster responses to end users. A security vulnerability exists in h2oai h2o-3, which stems from the fact that an attacker can overwrite arbitrary server files with...

PT-2023-32697

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 affected versions not specified Description The issue allows unauthenticated users to overwrite any file accessible to the user who executes h2o.init, potentially resulting in a denial of service. Remote unauthenticated attackers c...

CVE-2023-6722

A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of sensitive information. An attacker could access files such as application code or data, backend credentials, operating system files...

CVE-2023-6721

An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the fileupload function, resulting in interaction between the attacker and the server's file system...

PYSEC-2023-297

A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of sensitive information. An attacker could access files such as application code or data, backend credentials, operating system files...

PYSEC-2023-297

A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting in a disclosure of sensitive information. An attacker could access files such as application code or data, backend credentials, operating system files...

PT-2023-36082 · Repox · Repox

Name of the Vulnerable Software and Affected Versions: Repox affected versions not specified Description: A path traversal issue has been detected, allowing an attacker to read arbitrary files on the server. This could lead to the disclosure of sensitive information, including application code,...

Sumitomo Electric Industries RakRak Document Plus Security Vulnerability

Sumitomo Electric Industries RakRak Document Plus is a document management system from Sumitomo Electric Industries Japan. It can be used for a variety of purposes, including contract management, e-book legal compliance, drafting, and ISO document management. A security vulnerability exists in...

CVE-2023-6026

A Path traversal vulnerability has been reported in elijaa/phpmemcachedadmin affecting version 1.3.0. This vulnerability allows an attacker to delete files stored on the server due to lack of proper verification of user-supplied input...

UReport Security Vulnerability

UReport is a high-performance pure Java reporting engine based on the Spring architecture that prepares complex Chinese reports and statements by iterating over cells. A security vulnerability exists in UReport version v2.2.9. A remote attacker can exploit the vulnerability to arbitrarily read...

Headwind MDM Path Traversal Vulnerability

Headwind MDM is a platform for managing Android devices in your organization. A path traversal vulnerability exists in Headwind MDM Web panel version 5.22.1. An attacker can exploit this vulnerability to read arbitrary files on the server running the application...

Chalemelon Power Security Breach

Chalemelon Power is a shopping platform for virtual experiences. A security vulnerability exists in version 1.0 of the Chalemelon Power framework, which stems from a path traversal vulnerability in the getImage parameter. The vulnerability can be exploited to read files on the server and access...