D-Link Routers Path Traversal Vulnerability

D-Link Routers is a router from China-based AUO D-Link. A path traversal vulnerability exists in D-Link Routers. An attacker can exploit this vulnerability to read arbitrary system files by manipulating the URL...

Deep Java Library Security Vulnerability

Deep Java Library is an open source, high-level, engine-independent deep learning Java framework from Deep Java Library Open Source. A security vulnerability exists in Deep Java Library version 0.1.0 up to and including version 0.27.0, which stems from a vulnerability that will not prevent an...

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Overview Affected versions of this package are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' in the authentication process. An attacker can elevate privileges by exploiting race conditions during the token validation steps. This is only...

CVE-2024-5102

A sym-linked file accessed via the repair function in Avast Antivirus troubleshooting - repair feature, which attempts to delete a file in the current user's AppData directory as NT AUTHORITY\SYSTEM. A low-privileged user can make a pseudo-symlink and a junction folder and point to a file on the...

CVE-2024-5102 Elevation of Privelage via symlinked file in Avast Antivirus

A sym-linked file accessed via the repair function in Avast Antivirus troubleshooting - repair feature, which attempts to delete a file in the current user's AppData directory as NT AUTHORITY\SYSTEM. A low-privileged user can make a pseudo-symlink and a junction folder and point to a file on the...

ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`

ZendView is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or direct...

Information Disclosure

TYPO3/CMS is vulnerable to Information Disclosure. This vulnerability arises from insufficient validation and handling of uploaded files within forms. It may result in arbitrary file disclosure or unauthorized access to sensitive system files...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

CVE-2024-24919 Exploit Overview This repository contains...

Exploit for CVE-2024-4956

CVE-2024-4956 - Unauthenticated Path Traversal in Nexus Reposi...

CVE-2024-4956

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1...

CVE-2024-4956 Nexus Repository 3 - Path Traversal

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1...

CVE-2024-4956 Nexus Repository 3 - Path Traversal

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1...

CVE-2024-4956

Affected product: Sonatype Nexus Repository 3. Vulnerability: Path Traversal (CWE-22) allowing an unauthenticated attacker to read system files. Root cause / details: Unauthenticated path traversal in Nexus Repository 3 enables access to sensitive files; fixed in version 3.68.1. Impact (as stated...

GHSA-7GWJ-7FHM-VW4W Drupal core unrestricted file upload

Drupal 8 core's filesaveupload function does not strip the leading and trailing dot '.' from filenames, like Drupal 7 did. Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to...

CVE-2024-4357

An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 10.0.24.305 or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing...

CVE-2024-31475

There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI Aruba's access point management protocol. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to...

CVE-2024-0100

NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system files. A successful exploit of this vulnerability might lead to denial of service and data tampering...

ROS-20240507-06

A vulnerability in the xdg-desktop-portal interface of the Flatpak application and environment management tool is related to the injection or modification of arguments. Exploitation of the vulnerability could allow an attacker to to exit an isolated program environment and access files on the...

CVE-2024-28072 Arbitrary File Overwrite Vulnerability

A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly...

Zscaler Client Connector 安全漏洞

Zscaler Client Connector is an application from zscaler. An application that is installed on a device to ensure that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A...