CVE-2025-24813

CVE-2025-24813 - Apache Tomcat 경로 동등성 취약점 Apache Tomcat은 경로에서 ../ 시퀀스를 부적절하게 처리하여 Path Equivalence / Path Traversal 문제에 취약합니다. CVE ID: CVE-2025-24813 심각도: Critical 참고 링크: https://github.com/advisories/GHSA-83qj-6fr2-vhqg PoC 단계: 1.curl 요청을 PUT 메서드로 보냅니다: curl -X PUT...

CVE-2001-0931

CVE-2001-0931 Directory traversal vulnerability in Cooolsoft PowerFTP Server 2.03 allows attackers to list or read arbitrary files and directories via a .. dot dot in 1 LS or 2 GET. SecurityFocus publication at https://www.securityfocus.com/bid/3593/info Securiteam publication at...

CVE-2002-0347

CVE-2002-0347 Directory traversal vulnerability in Cobalt RAQ 4 allows remote attackers to read password-protected files, and possibly files outside the web root, via a .. dot dot in an HTTP request. Packetstorm publication at https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html...

Preproduce-CVE-2021-41773

CVE 2021-41773 재현 Apache HTTP Server 2.4.49의 경로 탐색 및 파일 노출 취약점 CVE-2021-41773 POC $ docker compose up 동작 확인 $ curl -I http://localhost HTTP/1.1 200 OK Date: Wed, 06 Oct 2021 13:25:18 GMT Server: Apache/2.4.49 Unix Last-Modified: Mon, 11 Jun 2007 18:53:14 GMT ETag: "2d-432a5e4a73a80" Accept-Ranges...

CVE-2024-4956-PoC

title="Nexus Repository Manager" GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 Windows NT 5.1; rv:21.0 Gecko/20100101 Firefox/21.0Connection: closeAccept: /Accept-Language: enAccept-Encoding: gzip...

CVE-2013-6987

CVE-2013-6987 Synology DiskStation Manager DSM 4.3-3810 Update 3 이전 버전의 FileBrowser 구성 요소에서 발생하는 여러 디렉터리 순회 취약점으로 인해 원격 공격자가 .. 점 점을 통해 임의의 파일을 읽고, 쓰고, 삭제할 수 있습니다. 사용법: python example: list filesystem python filelist.py ABCDFEGH1234 /home/../../../../...

NotCVE-2026-0009

nitroshare의 경로 탐색 취약점 설명 NitroShare Desktop v0.3.4에는 LAN 파일 전송 서버에 경로 탐색 취약점이 있습니다. 서버는 인증 없이 모든 네트워크 인터페이스포트 40818에서 수신 대기합니다. 파일을 수신할 때 발신자의 JSON 항목 헤더에 있는 name 필드는 확인 없이 전달되어 해석된 경로가 전송 루트 디렉터리C:\UserName\Downloads\NitroShare 내에 유지되는지 확인하지 않습니다. 동일한 LAN에 있는 공격자는 ../고전적인 점-점-슬래시 공격 시퀀스가 포함된 조작된...

CVE-2023-32315

CVE-2023-32315 GET /setup/setup-s/%002e%002e/Su002esu002e/log.jsp HTTP/1.1 Host: 192.168.40.132:9090 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; X64 AppleWebKit/537.36 KHTML, like Gecko Chrome/109.0.5414.120 Safari/537.36 Accept:...

CVE-2021-43798

CVE-2021-43798 1. 요약 Grafana는 데이터 모니터링 및 관리 기능을 지원하는 오픈소스 플랫폼으로, 아래 버전에서 ../과 같은 특수 문자를 사용해 파일 경로를 조작할 수 있는 Path Traversal 취약점이 존재한다. 8.0.0 이상, 8.0.7 미만 8.1.0 이상, 8.1.8 미만 8.2.0 이상, 8.2.7 미만 8.3.0 취약한 경로는 /public/plugins//로, 는 설치된 플러그인의 ID다. 아래 자료를 통해 취약한 경로를 확인할 수 있다...

CVE-2026-6925: Improper Limitation of a Pathname to a Restricted Directory

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2025-14753

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2025-14753

IBM Cloud Pak for Data 5.1.2 is vulnerable to a path traversal (CWE-22) attack. A remote, unauthenticated attacker can send a specially crafted URL containing "dot dot" (/../) sequences to traverse directories and view arbitrary files on the system, potentially exposing sensitive information. The...

CVE-2025-14753 IBM Cloud Pak for Data is vulnerable to path traversal

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

EUVD-2025-210936

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2025-14753: Improper Limitation of a Pathname to a Restricted Directory

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2026-92919: Improper Limitation of a Pathname to a Restricted Directory

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-54587: Improper Link Resolution Before File Access

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp, ownership, and permission operations. A local attacker able to modify part of the target installation tree could use...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to path traversal (CVE-2025-14753)

Summary IBM Cloud Pak for Data is vulnerable to a path traversal attack. A remote attacker could send a specially crafted URL containing "dot dot" sequences /../ to traverse directories and view arbitrary files on the system, potentially exposing sensitive information. Vulnerability Details...

DEBIAN-CVE-2026-88046

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

CVE-2026-88046 rclone: source object names can escape the configured root on upload

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...