Synapse path traversal vulnerability

Synapse is an application. for open federated instant messaging and VoIPSynapse. versions prior to Synapse 1.47.1 contain a path traversal vulnerability that could be exploited by an attacker to bypass the authentication process and download files from a remote server to an arbitrary directory...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

Path traversal

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

CVE-2021-38146

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

CVE-2021-38146

CVE-2021-38146 affects Wipro Holmes Orchestrator 20.4.1. The vulnerability is an unauthenticated, absolute path traversal in the File Download API (POST /home/download, SearchString parameter) that allows reading arbitrary server files. CVSS v3.1 base score 7.5 (HIGH) with network access, low att...

CVE-2021-38146: Improper Limitation of a Pathname to a Restricted Directory

The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data...

py-matrix-synapse -- several vulnerabilities

Matrix developers report: This release patches one high severity issue affecting Synapse installations 1.47.0 and earlier using the media repository. An attacker could cause these Synapses to download a remote file and store it in a directory outside the media repository. Note that: This only...

Xstream Java Library Code Execution

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability could allow an attacker to download and execute arbitrary code from a remote host by...

HPESBST04210 rev.1 - HPE Fibre Channel Host Bus Adapters Emulex HBA Manager, Multiple Remote Vulnerabilities

Potential Security Impact: Remote: Arbitrary File Download, Arbitrary File Modification, Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE 8Gb PCIe Host Bus Adapters - Prior to Emulex HBA Manager 12.8.542.26 - Please see VULNERABILTY SUMMARY section for model...

CVE-2020-7883

Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution...

Wipro Holmes Orchestrator 20.4.1 Arbitrary File Download Exploit

Exploit Title: Wipro Holmes Orchestrator 20.4.1 Unauthenticated Arbitrary File Read PoC Exploit Author: Rizal Muhammed @ub3rsick Vendor Homepage: https://www.wipro.com/holmes/ Version: 20.4.1 Tested on: Windows 10 x64 CVE : CVE-2021-38146 import requests as rq import argparse port = 8001 change...

TYPO3 Information Disclosure Vulnerability (CNVD-2022-17970)

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland.TYPO3 has an information disclosure vulnerability that originates from the extension's inability to protect or obfuscate the filename of uploaded files, which can be exploited by ...

CVE-2021-43564

An issue was discovered in the jobfair aka Job Fair extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded...

CVE-2021-43564

An issue was discovered in the jobfair aka Job Fair extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded...

CVE-2021-43564: Undefined Security Weakness

An issue was discovered in the jobfair aka Job Fair extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded...

Authentication flaw

A vulnerability has been identified in OpenPCS 7 V8.2 All versions, OpenPCS 7 V9.0 All versions V9.0 Upd4, OpenPCS 7 V9.1 All versions, SIMATIC BATCH V8.2 All versions, SIMATIC BATCH V9.0 All versions, SIMATIC BATCH V9.1 All versions, SIMATIC NET PC Software V14 All versions, SIMATIC NET PC...

CVE-2021-40359

CVE-2021-40359 is a path traversal vulnerability in Siemens products (OpenPCS 7, SIMATIC BATCH, SIMATIC NET PC Software, SIMATIC PCS 7, SIMATIC Route Control, SIMATIC WinCC, etc.). The issue arises from improper neutralization of special elements in pathnames when downloading files, allowing an a...

Siemens SIMATIC PCS 7 and SIMATIC WinCC have path traversal vulnerabilities

Siemens SIMATIC PCS 7 and SIMATIC WinCC are both products of Siemens, a German company. SIMATIC PCS 7 is a process control system and SIMATIC WinCC is an automated data acquisition and monitoring SCADA system. A path traversal vulnerability exists in SIMATIC PCS 7 and SIMATIC WinCC, which stems...