munhak-moa 路径遍历漏洞

munhak-moa is a literary platform for woduq1414 individual developers. A security vulnerability exists in munhak-moa, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

golem 路径遍历漏洞

golem is a git continuous integration, testing, and release tool by Dennis Kaarsemaker, an individual developer in the Netherlands. A security vulnerability exists in golem version 2016-05-17 and earlier, which stems from an incorrect call to Flask's sendfile function that results in absolute pat...

photo_tag 路径遍历漏洞

phototag is a photo tagging tool by the individual developer of Boring YiBa. A security vulnerability exists in phototag version 2020-08-31 and earlier versions, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

flask-mvc 路径遍历漏洞

flask-mvc is a repository by the individual developer Candra Nur Ihsan. A security vulnerability exists in flask-mvc version 2020-09-14 and earlier versions, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

VideoServer 路径遍历漏洞

VideoServer is a python3 UPnP/DLNA video server open source by shaolo1. VideoServer in 2019-09-21 and previous versions of a security vulnerability , the vulnerability stems from Flask's sendfile function is used insecurely to allow absolute path traversal...

swagger 路径遍历漏洞

swagger is a tool that provides Pure FlashArray and FlashBlade API documentation into the popular interactive Swagger UI. A security vulnerability exists in swagger version 1.1.5 and earlier, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

vprj 路径遍历漏洞

vprj is an open source repository for whmacmac. A security vulnerability exists in version 2022-04-06 and earlier versions of vprj, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

Mosiac 路径遍历漏洞

Mosiac is a web application for pixelated images. A security vulnerability exists in Mosiac version 1.0.0 and prior versions, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

sleep-learner 路径遍历漏洞

sleep-learner is a Canadian Yutong personal developer used to try to play recordings while a person sleeps in order to convey a message. A security vulnerability exists in sleep-learner version 2021-02-21 and earlier versions, which stems from an incorrect call to Flask's sendfile function that...

OpenMF 路径遍历漏洞

OpenMF is an open source mobile forensic investigation tool for the Android platform open sourced by SCoRe Lab. OpenMF has a security vulnerability in version 2022-05-03 and earlier that stems from an unsafe use of Flask's sendfile function that allows absolute path traversal...

Krypton 路径遍历漏洞

Krypton is a KryptoCurrency data relay service by Bolun Han Personal Developer. A security vulnerability exists in Krypton version 2021-06-03 and earlier, which stems from an incorrect call to Flask's sendfile function that results in absolute path traversal...

umbral 路径遍历漏洞

umbral is a NuCypher API open-sourced by decentraminds.ai for applying proxy re-encryption on decentralized marketplaces. A security vulnerability exists in umbral version 2020-01-15 and earlier, which stems from an incorrect call to Flask's sendfile function resulting in absolute path traversal...

Alkacon OpenCMS Absolute Path Traversal via pathname in filePath.0 parameter

Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter...

Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter

Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter...

CVE-2021-30497

Ivanti Avalanche Premise 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive...

CVE-2021-30497

Ivanti Avalanche Premise 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive...

Path traversal

Ivanti Avalanche Premise 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive...

CVE-2021-30497

Ivanti Avalanche Premise 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. The imageFilePath parameter processed by the /AvalancheWeb/image endpoint is not verified to be within the scope of the image folder, e.g., the attacker can obtain sensitive...

CVE-2021-30497

Ivanti Avalanche 6.3.2 on Premise is affected by CVE-2021-30497: a Local/File Inclusion/Absolute Path Traversal flaw in the /AvalancheWeb/image endpoint allows remote, unauthenticated users to read arbitrary files (e.g., C:\Windows\system32\config\system.sav) due to imageFilePath not being valida...

CVE-2022-25216

An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player recently renamed PlayerFab has read-access, by means of an HTTP GET request to http://:32080/download/...