54 matches found
Apache HTTP Server 2.4.49 - Path Traversal / RCE Detection (CVE-2021-41773)
Detects CVE-2021-41773 by reading /etc/passwd via encoded /.%%2e/ traversal under /cgi-bin or /icons, and optionally confirming CGI RCE via POST to bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 path traversal / CGI RCE CVE-2021-41773.""" import re from kittysploit...
Node-RED CVE-2026-71269 Library DoS Detect
Detects Node-RED 3.0.0–5.0.4 admin library API exposure for CVE-2026-71269: GET /library/local/flows on the httpAdminRoot surface. A reachable library endpoint indicates the target may be affected by the unauthenticated DoS via POST /library/local//%2e%2e discarded write promise crash on Node.js ...
Node.js st module Directory Traversal Detection
A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the st module before 0.""" import ...
ASUS DSL-AC88U - Authentication Bypass Detection
A vulnerability in the ASUS DSL-AC88U router permits unauthorized individuals to bypass authentication.When adding "/js/..%2f%2f" or "/images/..%2f%2e" to the requested URL, it will be recognized as passing the authentication.This vulnerability is part of a broader authentication bypass issue...
Malicious code in ds-cmd-line-2e-zh (npm)
The package ds-cmd-line-2e-zh was found to contain malicious code...
Malicious code in pyda-2e-zh (npm)
The package pyda-2e-zh was found to contain malicious code...
MAL-2025-44077 Malicious code in ds-cmd-line-2e-zh (npm)
The package ds-cmd-line-2e-zh was found to contain malicious code...
MAL-2025-45659 Malicious code in pyda-2e-zh (npm)
The package pyda-2e-zh was found to contain malicious code...
2e-bureau.com Cross Site Scripting vulnerability OBB-3313555
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-31469: Improper Neutralization of Input During Web Page Generation
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!&app=%2e./ URI...
CVE-2021-28164
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This ca...
PT-2021-16988
Name of the Vulnerable Software and Affected Versions AfterLogic Aurora versions 7.7.9 and earlier WebMail Pro versions 7.7.9 and earlier Description An issue allows directory traversal to read files, such as a settings.xml file containing admin panel credentials. This can be demonstrated by...
2e-architects.com Improper Access Control vulnerability OBB-1206910
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-12447: Improper Limitation of a Pathname to a Restricted Directory
A Local File Inclusion LFI issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow...
Node.js third-party modules: [Total.js] Path traversal vulnerability allows to read files outside public directory
I would like to report path traversal in Total.js. It allows read arbitrary files outside public directory. Module module name: Total.js version: 3.3.2 npm page: https://www.npmjs.com/package/total.js Module Description Total.js framework is a framework for Node.js platfrom written in pure...
CVE-2019-15517
jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal...
PT-2019-14239
Name of the Vulnerable Software and Affected Versions Nginx Proxy Manager versions prior to 2.0.13 Description The issue allows directory traversal due to a flaw in handling URLs, specifically the %2e%2e%2f sequence, which can be used to access files outside the intended directory structure...
PT-2018-13222
Name of the Vulnerable Software and Affected Versions Visiology Flipbox Software Suite versions prior to 2.7.0 Description The issue allows directory traversal due to insufficient sanitization of filename parameters, specifically via %5c%2e%2e%2f. Recommendations For versions prior to 2.7.0, upda...
Path traversal
serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e . and %2f / and allowing them in paths, which allows a malicious user to view the contents of any directory with known path...
PT-2017-5885
Name of the Vulnerable Software and Affected Versions: st versions prior to 0.2.5 Description: A directory traversal issue allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. The vulnerability is caused by the failure to properly handle URL encoded...