Filtered by CWE-552
Filtered by vendor Subscriptions
Total 345 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-53677 2024-12-20 9.0 Critical
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067
CVE-2023-34645 1 Jflyfox 1 Jfinal Cms 2024-12-18 7.5 High
jfinal CMS 5.1.0 has an arbitrary file read vulnerability.
CVE-2023-50164 1 Apache 1 Struts 2024-12-17 9.8 Critical
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
CVE-2024-50627 2024-12-11 8.8 High
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on the local area network (with specific permissions) to upload and execute malicious files, potentially leading to unauthorized system access.
CVE-2024-53676 1 Hpe 1 Insight Remote Support 2024-12-11 9.8 Critical
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.
CVE-2022-42834 1 Apple 1 Macos 2024-12-10 3.3 Low
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13, macOS Big Sur 11.7.3. An app may be able to access mail folder attachments through a temporary directory used during compression
CVE-2023-5101 1 Sick 2 Apu0200, Apu0200 Firmware 2024-12-09 5.3 Medium
Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests.
CVE-2023-29931 1 Laravels Project 1 Laravels 2024-12-07 9.8 Critical
laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.
CVE-2023-36664 4 Artifex, Debian, Fedoraproject and 1 more 5 Ghostscript, Debian Linux, Fedora and 2 more 2024-12-05 7.8 High
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
CVE-2024-51542 1 Abb 3 Aspect Enterprise, Matrix Series, Nexus Series 2024-12-05 8.2 High
Configuration Download vulnerabilities allow access to dependency configuration information.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
CVE-2024-6209 1 Abb 38 Aspect-ent-12, Aspect-ent-12 Firmware, Aspect-ent-2 and 35 more 2024-12-05 10 Critical
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized
CVE-2018-0106 1 Cisco 1 Elastic Services Controller 2024-12-03 3.3 Low
A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an unauthenticated, local attacker to access sensitive information on a targeted system. The vulnerability is due to insufficient security restrictions. An attacker could exploit this vulnerability by accessing unauthorized information within the ConfD directory and file structure. Successful exploitation could allow the attacker to view sensitive information. Cisco Bug IDs: CSCvg00221.
CVE-2023-34834 1 Mcl-collection 2 Mcl-net, Mcl-net Firmware 2024-11-27 5.3 Medium
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint.
CVE-2024-51058 1 Tcpdf Project 1 Tcpdf 2024-11-26 6.2 Medium
Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through <img> src tag, potentially exposing sensitive information.
CVE-2024-45894 2024-11-26 4.9 Medium
BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.
CVE-2024-8535 1 Netscaler 2 Adc, Gateway 2024-11-21 N/A
Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources
CVE-2024-6878 1 Eliz Software 1 Panel 2024-11-21 N/A
Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations.This issue affects Panel: before v2.3.24.
CVE-2024-10126 2024-11-21 N/A
Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read server local files of a limited set of filetypes via document preview.
CVE-2023-4743 1 Dreamer Cms Project 1 Dreamer Cms 2024-11-21 3.1 Low
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238632. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-6911 1 Perkinelmer 1 Processplus 2024-11-21 7.5 High
Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus: through 1.11.6507.0.