CVE-2013-6987

CVE-2013-6987 Mehrere Verzeichnis-Pfad-Traversal-Schwachstellen in den FileBrowser-Komponenten von Synology DiskStation Manager DSM vor 4.3-3810 Update 3 erlauben entfernten Angreifern, beliebige Dateien zu lesen, zu schreiben und zu löschen, mittels .. Punkt-Punkt Verwendung: root@kitploit: pyth...

EUVD-2026-42285

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read...

NotCVE-2026-0009

Vulnerabilità di Path Traversal in nitroshare Descrizione NitroShare Desktop v0.3.4 contiene una vulnerabilità di path traversal nel suo server di trasferimento file LAN. Il server resta in ascolto su tutte le interfacce di rete porta 40818 senza autenticazione. Quando riceve file, il campo name...

CVE-2021-43798

CVE-2021-43798 1. Sintesi Grafana è una piattaforma open-source che supporta il monitoraggio e la gestione dei dati. Nelle versioni seguenti esiste una vulnerabilità Path Traversal che consente di manipolare il percorso del file utilizzando caratteri speciali come ../. 8.0.0 e successive,...

CVE-2024-4956-PoC

title="Nexus Repository Manager" GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 Windows NT 5.1; rv:21.0 Gecko/20100101 Firefox/21.0Connection: closeAccept: /Accept-Language: enAccept-Encoding: gzip...

CVE-2023-32315

CVE-2023-32315 root@kitploit: GET /setup/setup-s/%002e%002e/Su002esu002e/log.jsp HTTP/1.1 Host: 192.168.40.132:9090 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; X64 AppleWebKit/537.36 KHTML, like Gecko Chrome/109.0.5414.120 Safari/537.36 Accept:...

Preproduce-CVE-2021-41773

Riproduzione di CVE 2021-41773 Vulnerabilità di path traversal e divulgazione di file in Apache HTTP Server 2.4.49 CVE-2021-41773 POC root@kitploit: $ docker compose up Conferma che funziona root@kitploit: $ curl -I http://localhost HTTP/1.1 200 OK Date: Wed, 06 Oct 2021 13:25:18 GMT Server:...

CVE-2025-24813

CVE-2025-24813 - Vulnerabilità di Path Equivalence in Apache Tomcat Apache Tomcat è vulnerabile a un problema di Path Equivalence / Path Traversal dovuto alla gestione impropria delle sequenze ../ nei percorsi. ID CVE: CVE-2025-24813 Gravità: Critica Link di riferimento:...

Linux Distros Unpatched Vulnerability : CVE-2026-79781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in ...

CVE-2026-79781

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-79781

rclone serve s3 before version 1.74.4 contains a path traversal vulnerability in its handling of S3 object keys. An unauthenticated, network-based attacker can include dot-dot (../) segments in object key names (e.g., ../root-secret.txt) to escape the bucket namespace and read or overwrite files ...

EUVD-2026-65539

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2002-0347

CVE-2002-0347 ثغرة اجتياز الدليل في Cobalt RAQ 4 تسمح للمهاجمين عن بُعد بقراءة الملفات المحمية بكلمة مرور، وربما الملفات خارج جذر الويب، عبر .. نقطتان في طلب HTTP. منشور Packetstorm على https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html منشور SecurityFocus على...

CVE-2001-0931

CVE-2001-0931 La vulnerabilità di directory traversal in Cooolsoft PowerFTP Server 2.03 consente agli attaccanti di elencare o leggere file e directory arbitrari tramite .. dot dot in 1 LS o 2 GET. Pubblicazione SecurityFocus su https://www.securityfocus.com/bid/3593/info Pubblicazione Securiteam...

CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-71313 rclone: Local Encoding Path Traversal

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-71313 rclone: Local Encoding Path Traversal

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an...