BIT-EJBCA-2022-34831

An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one o...

acmejewel.com Cross Site Scripting vulnerability OBB-3865374

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Arbitrary File Read

Appwrite is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of user-supplied input when creating an ACME challenge file, allowing an attacker to manipulate the request URI to access arbitrary files. The vulnerability is only exploitable if the...

Appwrite Directory Traversal vulnerability

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. This pathname is automatically created if...

CVE-2022-25377

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. This pathname is automatically created if...

Directory traversal

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. This pathname is automatically created if...

PT-2024-11533 · Appwrite · Appwrite

Name of the Vulnerable Software and Affected Versions: Appwrite versions 0.5.0 through 0.12.x before 0.12.2 Description: The issue allows remote attackers to read arbitrary local files via ../ directory traversal in the "ACME-challenge" endpoint. This vulnerability requires the existence of APP...

CVE-2022-25377

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. This pathname is automatically created if...

Appwrite Security Vulnerabilities

Appwrite is Appwrite open source an end-to-end backend server . Used to package into a set of Docker microservices for web, mobile, native or backend applications. A security vulnerability exists in Appwrite versions 0.5.0 through 0.12.2, which stems from an ACME-challenge endpoint that allows...

CVE-2022-25377

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. This pathname is automatically created if...

CVE-2022-25377

Appwrite versions 0.5.0 through 0.12.x before 0.12.2 are vulnerable to a directory traversal vulnerability in the ACME-challenge endpoint . This flaw allows remote attackers to read arbitrary local files by using ../ sequences. The vulnerability specifically requires the existence of the APP_STOR...

CVE-2022-25377: Improper Limitation of a Pathname to a Restricted Directory

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. This pathname is automatically created if...

io.micronaut.acme:micronaut-acme (2.1.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.1.4)

io.micronaut:micronaut-http-server-netty MAVEN version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - io.micronaut.acme:micronaut-acme 2.1.0 Source cves: CVE-2024-23639 Source...

io.micronaut.acme:micronaut-acme (3.0.0-rc1), net.javacrumbs.shedlock:shedlock-micronaut (4.25.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.5.8)

io.micronaut:micronaut-http-server-netty MAVEN version 2.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - io.micronaut.acme:micronaut-acme 3.0.0-rc1 -...

io.micronaut.acme:micronaut-acme (2.1.0), io.micronaut.groovy:micronaut-multitenancy-gorm (2.2.0) +12 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.1.4)

io.micronaut:micronaut-http-server MAVEN version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.acme:micronaut-acme 2.1.0 - io.micronaut.groovy:micronaut-multitenancy-gorm...

io.micronaut.acme:micronaut-acme (3.0.0-rc1), io.micronaut:micronaut-function-web (2.5.8) +2 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.5.8)

io.micronaut:micronaut-http-server MAVEN version 2.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.acme:micronaut-acme 3.0.0-rc1 - io.micronaut:micronaut-function-web 2.5.8 -...

com.slack.api:bolt-micronaut (>=1.10.0, <=1.15.0), io.micronaut.acme:micronaut-acme (>=3.0.0, <=3.0.1) +1 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.5.12)

io.micronaut:micronaut-http-server-netty MAVEN version 2.5.12 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut =1.10.0, =3.0.0, =3.0.1 -...

objstor (>=0.4.6, <=0.4.20), trillium-acme (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2024-23644 via trillium-client (>=0.2.2, <=0.4.9)

trillium-client CARGO version =0.2.2, =0.4.6, =0.1.0, =0.2.0, =0.5.0 Source cves: CVE-2024-23644 Source advisory: OSV:GHSA-9F9P-CP3C-72JF...

objstor (>=0.4.6, <=0.4.20), trillium-acme (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2024-23644 via trillium-client (>=0.2.2, <=0.4.9)

trillium-client CARGO version =0.2.2, =0.4.6, =0.1.0, =0.2.0, =0.5.0 Source cves: CVE-2024-23644 Source advisory: OSV:RUSTSEC-2024-0008...

CVE-2024-0263

A vulnerability was found in ACME Ultra Mini HTTPd 1.21. It has been classified as problematic. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to th...