CVE-2023-2316

HIGH Year: 2023
CVSS v3 Score
7.4
High
Weakness Type
CWE-22
View all →

Vulnerability Description

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.

Related Vulnerabilities

CVE-2016-2087

HIGH
CVSS:7.4(High)

Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server name.

CWE-222016

CVE-2019-5624

HIGH
CVSS:7.4(High)

Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this...

CWE-222019

CVE-2019-8320

HIGH
CVSS:7.4(High)

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would dele...

CWE-222019

CVE-2021-20218

HIGH
CVSS:7.4(High)

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to ext...

CWE-222021

CVE-2024-29180

HIGH
CVSS:7.4(High)

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is ...

CWE-222024

CVE-2024-47027

HIGH
CVSS:7.4(High)

In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation. This could lead to local escalation of privilege with no add...

CWE-222024