CVE-2021-21251 ZipSlip Arbitrary File Upload

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file write. The KubernetesResource REST endpoint untars user controlled data from the request body using TarUtils. TarUtils is a custom library...

CVE-2019-19287

A vulnerability has been identified in XHQ All Versions 6.1. The web interface could allow attackers to traverse through the file system of the server based by sending specially crafted packets over the network without authentication...

CVE-2019-19287

Siemens XHQ Operations Intelligence prior to version 6.1 contains a relative path traversal vulnerability in the web interface that could allow an unauthenticated remote attacker to traverse the server file system by sending specially crafted packets over the network. Affected: XHQ, all versions

Security Bulletin: IBM QRadar Incident Forensics is vulnerable to using component with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2018-8009 DESCRIPTION: Apache Hadoop could could allow a remote attacker to traverse directories on the system. By persuading a...

CVE-2020-12003

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 an...

Code injection

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 an...

CVE-2020-12003

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 an...

CVE-2020-12003

CVE-2020-12003 affects Rockwell Automation products including FactoryTalk Linx (v6.00, 6.10, 6.11), RSLinx Classic (v4.11.00 and prior), Connected Components Workbench (v12 and prior), ControlFLASH (v14+), ControlFLASH Plus (v1+), FactoryTalk Asset Centre (v9+), FactoryTalk Linx CommDTM (v1+), St...

CVE-2020-12001

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 an...

Linear eMerge E3-Series Path Traversal Vulnerability

The Nortek Security & Control Linear eMerge E3-Series is an access control device from Nortek Security & Control USA. A path traversal vulnerability exists in the Linear eMerge E3-Series device, which stems from the program failing to properly handle sequences such as '... /' and other sequences...

CVE-2018-15540

Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse the file system to unintended locations and/or access arbitrary files, aka /media/api Directory Traversal...

Debian DLA-1415-1 : phpmyadmin security update

Several vulnerabilities were found in phpMyAdmin, the web-based MySQL administration interface, including SQL injection attacks, denial of service, arbitrary code execution, cross-site scripting, server-side request forgery, authentication bypass, and file system traversal. For Debian 8 'Jessie',...

Debian: Security Advisory (DLA-1415-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-9349

An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. An attacker could traverse the file system and extract files that can result in information disclosure...

CVE-2016-9349

CVE-2016-9349 affects Advantech SUSIAccess Server (

CVE-2016-6614

An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions prior...

CVE-2016-6614

CVE-2016-6614 affects phpMyAdmin and is caused by the %u username replacement used by SaveDir and UploadDir, enabling a specially crafted username to bypass file-system restrictions (Filesystem traversal). Affected versions: all 4.6.x prior to 4.6.4, all 4.4.x prior to 4.4.15.8, and all 4.0.x pri...

Advantech SUSIAccess Server Information Disclosure Vulnerability

SUSIAccess is an easy-to-use remote device management software solution. An information disclosure vulnerability exists in Advantech SUSIAccess Server. An attacker can exploit the vulnerability to traverse the file system to obtain sensitive information...

Siemens SIMATIC WinCC OA Multiple Vulnerabilities

OVERVIEW Researchers Gleb Gritsai, Ilya Karpov, and Kirill Nesterov of Positive Technologies have identified multiple vulnerabilities in the Siemens SIMATIC WinCC Open Architecture OA application. Siemens has produced updates that mitigate these vulnerabilities. These vulnerabilities could be...

Siemens SINEMA Vulnerabilities

OVERVIEW Siemens has identified vulnerabilities in SINEMA server. Siemens has produced a software update that mitigates these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following Siemens product is affected: SINEMA server: all versions prior to V12 S...