CVE-2025-24908

Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. CWE-35 Description Hitachi Vantara...

CVE-2025-24907

Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. CWE-35 Description Hitachi...

CVE-2024-48914

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

EUVD-2024-52034

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following...

CVE-2024-53691

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following...

CVE-2024-53691

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following...

CVE-2024-50404

A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: Qsync Central...

CVE-2024-50404 Qsync Central

A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: Qsync Central...

CVE-2024-50404

CVE-2024-50404 affects Qsync Central. A symlink/ZIP upload flaw allows a user with upload privileges to traverse the file system and disclose or modify sensitive targets (e.g., /etc/passwd, /etc/shadow) by uploading a ZIP containing a symlink to a protected path. Affected versions are Qsync Centr...

CVE-2024-53691 QTS, QuTS hero

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following...

CVE-2024-53691

Summary : CVE-2024-53691 affects QNAP QTS and QuTS hero. A symlink/link-following vulnerability in ZIP extraction allows an attacker with basic user access to traverse the file system to unintended locations due to improper link resolution before file access. Impact (as described) : potential fil...

CVE-2024-53691 QTS, QuTS hero

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following...

PT-2024-34179

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.4.0.16 Description: A link following vulnerability has been reported to affect Qsync Central, allowing remote attackers who have gained user access to traverse the file system to unintended locations...

CVE-2024-48862 QuLog Center

A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed the vulnerability in the followin...

CVE-2024-48862

CVE-2024-48862 affects QNAP’s QuLog Center. A link-following vulnerability could allow remote attackers to traverse the file system and read or overwrite files. Affected versions are prior to 1.7.0.831 and prior to 1.8.0.888; fixed in 1.7.0.831+ and 1.8.0.888+. CVSS metrics indicate high impact (...

CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

PT-2024-10148 · Qnap · Qts +1

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.8.2823 build 20240712 QTS versions prior to 5.2.0.2802 build 20240620 QuTS hero versions prior to h5.1.8.2823 build 20240712 QuTS hero versions prior to h5.2.0.2802 build 20240620 Description: The issue is related to...

Hitachi XMC20 Security Vulnerability

Hitachi XMC20 is a multi-service remote communication network element from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi XMC20, which originates from an attacker being able to traverse the file system to access otherwise inaccessible files or directories...

CVE-2024-25693

Summary: CVE-2024-25693 is a path traversal vulnerability in Esri Portal for ArcGIS affecting versions up to 11.2. An authenticated, remote attacker could traverse the file system to access files or execute code outside the intended directory. Affected product/versions: Esri Portal for ArcGIS,