PT-2020-13332

Name of the Vulnerable Software and Affected Versions Little Snitch versions 4.5.1 and older Description The issue allows a user to escalate to root by manipulating a directory path controlled by the user, which can be linked to a directory containing code executed by root. Recommendations For...

Buildah Path Traversal

The vulnerability of the Buildah command-line tool exists due to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to create a malicious container image and replace arbitrary files on the user’s system...

tar-archives obs-service-tar_scm Code Execution

The vulnerability of the tar-archive packaging service, obs-service-tarscm, is related to incorrect restrictions on the path name for the restricted access directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or execute arbitrary co...

Django AdminURLFieldWidget XSS

The vulnerability of the AdminURLFieldWidget function in the Django web development framework is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...

CVE-2020-5195

Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folderup.png IMG element not properly sanitizing user-inserted directory...

Apple Shortcuts for iOS Input Validation Error Vulnerability

Apple Shortcuts for iOS is a set of shortcut applications from Apple USA based on the iOS platform. A security vulnerability exists in the handling of directory paths in versions of Apple Shortcuts for iOS prior to 2.1.3. A local attacker can exploit the vulnerability to view sensitive user...

PT-2019-5255

Name of the Vulnerable Software and Affected Versions Citrix Application Delivery Controller ADC and Gateway versions 10.5 through 13.0 Description The issue exists due to incorrect restriction of the directory path name with limited access. Exploitation of this issue may allow a remote attacker ...

NeoMutt newsrc.c Data Compromise

The vulnerability in the newsrc.c component of the NeoMutt email client exists due to an incorrect limitation on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

Cisco IOS XE Path Traversal

The vulnerability of the Cisco IOS XE operating system exists due to errors in path name restrictions for restricted access directories. Exploiting this vulnerability allows a malicious individual, who operates locally and is a user of the guest operating system, to execute arbitrary code on the...

PT-2019-6302

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.22.1 Description The issue is related to incorrect restriction of directory path names in a directory with limited access. Exploitation of this issue may allow a remote attacker to upload arbitrary files to the...

PT-2019-6415

Name of the Vulnerable Software and Affected Versions FANUC Robotics Virtual Robot Controller version 8.23 Description The issue is related to incorrect restriction of directory path names with limited access in the web server of the FANUC Robotics Virtual Robot Controller software. Exploitation ...

PT-2019-2819 · Mcafee · Mcafee Enterprise Security Manager

Name of the Vulnerable Software and Affected Versions: McAfee Enterprise Security Manager versions prior to 11.2.0 McAfee Enterprise Security Manager versions prior to 10.4.0 Description: The issue allows an authenticated user to execute arbitrary code via specially crafted parameters. This is du...

AROX School-ERP Pro Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "AROX School-ERP Pro Unauthenticated Remote Code Execution", 'Description' = %q This module exploits a command execution vulnerability in AROX...

Cisco TelePresence Video Communication Server Web Interface Bypass

The vulnerability of the web interface of the microprogramming software for Cisco TelePresence Video Communication Servers and Cisco Expressway software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to bypass...

CVE-2019-10247

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...

PT-2019-5450

Name of the Vulnerable Software and Affected Versions Adobe XD versions 16.0 and earlier Description The issue is due to incorrect restriction of a directory path with limited access. Successful exploitation could lead to arbitrary code execution in the context of the current user. Recommendation...

Microsoft SharePoint Enterprise Server Access Control Disclosure

The vulnerability of the Microsoft SharePoint Enterprise Server package is related to access control errors. Exploiting this vulnerability can allow an attacker to disclose sensitive information by viewing the path to the script directory uploaded to the page...

Cisco Prime File Upload Arbitrary File Execution

The vulnerability of the Cisco Prime File Upload service in the Data Center Network Manager DCNM and the Prime Infrastructure PI network lifecycle management software is due to errors in specifying the path to the directory, as well as the absence of restrictions during the upload of files of a...

CVE-2018-0405

A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due...

CVE-2018-0405 Cisco RV180W Wireless-N Multifunction VPN Router Directory Path Traversal Vulnerability

A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due...