2246 matches found
CVE-2024-48931 ZimaOS Arbitrary File Read via Parameter Manipulation
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the ZimaOS API endpoint http:///v3/file?token=&files= is vulnerable to arbitrary file reading due to improper input validation. By manipulating the files...
CVE-2024-20370
A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to elevate their administrative privileges to root. The attacker would need...
CVE-2024-41717
CVE-2024-41717 affects Kieback&Peter DDC4000 series controllers (DDC4002, 4100, 4200, 4200-L, 4400 and related E-series) with a path traversal (CWE-22) vulnerability that allows an unauthenticated attacker to read files on the system. CVSSv3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H);...
UBUNTU-CVE-2024-49860
In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of STR method Only buffer objects are valid return values of STR. If something else is returned descriptionshow will access invalid memory...
Qnap QTS Path Traversal (CVE-2021-28798)
A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 202104...
CVE-2024-9983 Ragic Enterprise Cloud Database - Arbitrary File Read through Path Traversal
Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files...
Ragic Enterprise Cloud Database 安全漏洞
Ragic Enterprise Cloud Database is an enterprise cloud database from Ragic, Inc. A security vulnerability exists in versions of Ragic Enterprise Cloud Database prior to 2024/08/08 09:45:25, which stems from failure to properly validate specific page parameters, allowing an unauthenticated, remote...
CVE-2024-9924
The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can download arbitrary system files, which may be deleted subsequently...
CVE-2024-9923
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access them...
CVE-2024-9924
CVE-2024-9924 describes an Arbitrary File Read and Delete vulnerability in HGiga OAKlouds. An unauthenticated remote attacker can request specific files and download arbitrary system files, with reports indicating the files may be deleted after download. The issue is connected to CVE-2024-26261, ...
CVE-2024-9923 TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Move through Path Traversal
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access them...
CVE-2024-9923
The CVE-2024-9923 vulnerability affects Team+ by TEAMPLUS TECHNOLOGY (Team+ 13.5.x) and stems from improper validation of a specific page parameter, enabling a remote attacker with administrator privileges to move arbitrary system files to the website root and access them. This is a path-traversa...
CVE-2024-9922
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files...
CVE-2024-9922
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files...
Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2024-737)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-737 advisory. A vulnerability in the PDF parsing module of Clam AntiVirus ClamAV versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x...
PT-2024-39937 · Teamplus Technology · Team+
Name of the Vulnerable Software and Affected Versions: Team+ versions affected versions not specified Description: The issue is related to the improper validation of a specific page parameter in Team+ by TEAMPLUS TECHNOLOGY, allowing unauthenticated remote attackers to read arbitrary system files...
CVE-2024-47769
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
CVE-2024-47769
Summary: CVE-2024-47769 affects IDURAR, an open-source ERP/CRM. The vulnerability is in corePublicRouter.js where a public endpoint is accessible to unauthenticated users and user input is directly appended to a join statement, enabling a URL-encoded payload to be processed. This can allow an att...
CVE-2024-47769 IDURAR has a Path Traversal (unauthenticated user can read sensitive data)
IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference usage here, it is identified that the public endpoint is accessible to an unauthenticated user. The user's input is directly appended to the join statement...
