CVE-2022-23457 Path Traversal in ESAPI

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPathString, String, File, boolean may incorrectly treat the tested input string as a child of the specified...

OWASP ESAPI 路径遍历漏洞

OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. A path traversal vulnerability exists in ESAPI versions prior to 2.3.0.0, which stems from the default implementation of...

PT-2022-2299 · Cisco · Cisco Iox +1

Name of the Vulnerable Software and Affected Versions: Cisco IOx affected versions not specified Description: The issue exists due to incorrect restriction of the directory path name with limited access. An attacker could inject arbitrary commands into the underlying host operating system, execut...

PT-2022-2849 · Cisco · Cisco Iox +1

Name of the Vulnerable Software and Affected Versions: Cisco IOx affected versions not specified Description: Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operati...

PT-2022-2850 · Cisco · Cisco Iox +1

Name of the Vulnerable Software and Affected Versions: Cisco IOx affected versions not specified Description: Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operati...

PT-2022-2300 · Cisco · Cisco Iox +1

Name of the Vulnerable Software and Affected Versions: Cisco IOx affected versions not specified Description: The issue exists due to incorrect restriction of a directory path name with limited access. An attacker could inject arbitrary commands into the underlying host operating system, execute...

D-Link DAP-1620 Path Traversal

The vulnerability of the microprogrammed software in D-Link DAP-1620 wireless repeaters is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information through the /etc/passwd and...

Tiny File Manager 2.4.6 Shell Upload

Exploit Title: Tiny File Manager 2.4.6 - Remote Code Execution RCE Date: 14/03/2022 Exploit Author: FEBIN MON SAJI Software Link: https://github.com/prasathmani/tinyfilemanager Version: Tiny File Manager Example: $0 http://files.ubuntu.local/index.php admin "admin@123" " log-in URL=$1 admin=$2...

qt/qtbase Code Execution

The vulnerability of the qt/qtbase package from the Qt library is related to an incorrect limitation on the path to the restricted directory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

UBUNTU-CVE-2021-32841

SharpZipLib or ziplib is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that destDir ends with slash. If the destDir is not slash terminated like...

PT-2022-10095

Name of the Vulnerable Software and Affected Versions SharpZipLib versions 1.3.0 through 1.3.2 Description The issue affects SharpZipLib, a library for handling Zip, GZip, Tar, and BZip2 files. It arises from the lack of enforcement that the destination directory path ends with a slash, allowing...

Huawei HarmonyOS Get Distributed Directory Path Interface Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. Huawei HarmonyOS is vulnerable to a distributed directory path interface vulnerability. An attacker could exploit this vulnerability to compromise user confidentiality...

Huawei HarmonyOS 信息泄露漏洞

Huawei HarmonyOS is an operating system from Huawei China. Huawei HarmonyOS is vulnerable to a distributed directory path interface vulnerability. An attacker could exploit this vulnerability to compromise user confidentiality...

Moxa MXView Path Traversal

The vulnerability of the Moxa MXView network control software is related to deficiencies in checking the path name of the restricted access catalog. Exploiting this vulnerability allows a malicious actor to create or re-record arbitrary files remotely...

PT-2021-7453

Name of the Vulnerable Software and Affected Versions Moxa MXView affected versions not specified Description The issue is related to insufficient checks on the directory path name with limited access in Moxa MXView network control software. Exploitation of this issue may allow a remote attacker ...

CVE-2021-1739

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A local user may be able to modify...

CVE-2021-1740

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Security Update 2021-002 Catalina, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A local user may be able to modify protected parts of the file system...

CVE-2021-1739

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A local user may be able to modify...

CVE-2021-1740

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Security Update 2021-002 Catalina, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A local user may be able to modify protected parts of the file system...

PT-2021-4939 · Advantech +1 · Advantech R-Seenet +1

Name of the Vulnerable Software and Affected Versions: Advantech R-SeeNet version 2.4.15 Description: A privilege escalation issue exists in the Windows version of Advantech R-SeeNet, related to insufficient access control to the directory C:R-SeeNet. This can allow an attacker to elevate their...