51 matches found
Apache HTTP Server 2.4.49 - Path Traversal / RCE Detection (CVE-2021-41773)
Detects CVE-2021-41773 by reading /etc/passwd via encoded /.%%2e/ traversal under /cgi-bin or /icons, and optionally confirming CGI RCE via POST to bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 path traversal / CGI RCE CVE-2021-41773.""" import re from kittysploit...
Malicious code in pyda-2e-zh (npm)
The package pyda-2e-zh was found to contain malicious code...
Malicious code in ds-cmd-line-2e-zh (npm)
The package ds-cmd-line-2e-zh was found to contain malicious code...
MAL-2025-44077 Malicious code in ds-cmd-line-2e-zh (npm)
The package ds-cmd-line-2e-zh was found to contain malicious code...
MAL-2025-45659 Malicious code in pyda-2e-zh (npm)
The package pyda-2e-zh was found to contain malicious code...
2e-bureau.com Cross Site Scripting vulnerability OBB-3313555
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-31469: Improper Neutralization of Input During Web Page Generation
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!&app=%2e./ URI...
CVE-2021-28164
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This ca...
PT-2021-16988
Name of the Vulnerable Software and Affected Versions AfterLogic Aurora versions 7.7.9 and earlier WebMail Pro versions 7.7.9 and earlier Description An issue allows directory traversal to read files, such as a settings.xml file containing admin panel credentials. This can be demonstrated by...
2e-architects.com Improper Access Control vulnerability OBB-1206910
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-12447: Improper Limitation of a Pathname to a Restricted Directory
A Local File Inclusion LFI issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to read sensitive files via %2e%2e%2f directory traversal, as demonstrated by reading /etc/shadow...
Node.js third-party modules: [Total.js] Path traversal vulnerability allows to read files outside public directory
I would like to report path traversal in Total.js. It allows read arbitrary files outside public directory. Module module name: Total.js version: 3.3.2 npm page: https://www.npmjs.com/package/total.js Module Description Total.js framework is a framework for Node.js platfrom written in pure...
CVE-2019-15517
jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal...
PT-2019-14239
Name of the Vulnerable Software and Affected Versions Nginx Proxy Manager versions prior to 2.0.13 Description The issue allows directory traversal due to a flaw in handling URLs, specifically the %2e%2e%2f sequence, which can be used to access files outside the intended directory structure...
PT-2018-13222
Name of the Vulnerable Software and Affected Versions Visiology Flipbox Software Suite versions prior to 2.7.0 Description The issue allows directory traversal due to insufficient sanitization of filename parameters, specifically via %5c%2e%2e%2f. Recommendations For versions prior to 2.7.0, upda...
Path traversal
serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e . and %2f / and allowing them in paths, which allows a malicious user to view the contents of any directory with known path...
PT-2017-5885
Name of the Vulnerable Software and Affected Versions: st versions prior to 0.2.5 Description: A directory traversal issue allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. The vulnerability is caused by the failure to properly handle URL encoded...
CA 2E Web Option session spooging
Pridictable session token...
CA 2E Web Option 8.1.2身份验证绕过漏洞
CVECAN ID: CVE-2014-1219 CA 2E Web Option是CA 2E应用Web接口开发工具。 CA 2E Web Option r8.1.2生成会议令牌的方式可以预测，在实现上存在安全漏洞，这可使远程攻击者绕过身份验证机制。 0 CA 2E Web Option 8.1.2 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.ca.com/us//media/files/productbriefs/cs3003-ca-2e-web-option.aspx Vulnerability title:...
CVE-2014-1219
CA 2E Web Option r8.1.2 accepts a predictable substring of a W2ESSNID session token in place of the entire token, which allows remote attackers to hijack sessions by changing characters at the end of this substring, as demonstrated by terminating a session via a modified SSNID parameter to...