62 matches found
CVE-2022-31474
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1...
CVE-2022-1390: Improper Limitation of a Pathname to a Restricted Directory
The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a...
CVE-2022-20719: Improper Limitation of a Pathname to a Restricted Directory
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being...
PT-2022-10059
Name of the Vulnerable Software and Affected Versions Secomea GateManager versions prior to 9.6.621421014 Description The issue is related to an improper limitation of a pathname to a restricted directory. This allows a logged-in GateManager admin to delete system files or directories...
CVE-2021-44665: Improper Limitation of a Pathname to a Restricted Directory
A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via download.php...
Design/Logic Flaw
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the context of the user running IGSS, due to missing validation of user supplied data in network messages. Affected Product: Interactive Graphica...
PT-2022-1815
Name of the Vulnerable Software and Affected Versions Interactive Graphical SCADA System Data Server versions V15.0.0.22020 and prior Description A vulnerability exists that could cause modification of an existing file by inserting at the beginning of the file or create a new file in the context ...
CVE-2021-37347: Improper Limitation of a Pathname to a Restricted Directory
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument...
CVE-2021-22762
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists inIGSS Definition Def.exe V15.0.0.21140 and prior that could result in remote code execution, when a malicious CGF or WSP file is being parsed by IGSS Definition...
CVE-2020-7473: Improper Limitation of a Pathname to a Restricted Directory
In certain situations, all versions of Citrix ShareFile StorageZones aka storage zones Controller, including the most recent 5.10.x releases as of May 2020, allow unauthenticated attackers to access the documents and folders of ShareFile users. NOTE: unlike most CVEs, exploitability depends on th...
CVE-2019-16113: Improper Limitation of a Pathname to a Restricted Directory
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname...
keepalived security update
CentOS Errata and Security Advisory CESA-2019:2285 An update for keepalived is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...
RHEL 7 : keepalived (RHSA-2019:2285)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:2285 advisory. The keepalived utility provides simple and robust facilities for load balancing and high availability. The load balancing framework relies on the...
Arbitrary File Overwrite
keepalived is vulnerable to arbitrary file overwrite. The vulnerability exists as there is an improper pathname validation that allows for overwrite of arbitrary filenames via symlinks...
CVE-2018-20769: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is a Local File Inclusion vulnerability...
CVE-2018-7486: Improper Limitation of a Pathname to a Restricted Directory
Blue River Mura CMS before v7.0.7029 supports inline function calls with an m tag and /m end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an m$.dspinclude"../pathname/executable.jpeg"/m approach, where executable.jpeg...
SeaWell Networks Spectrum SDC 02.05.00 Traversal / Privilege Escalation
Exploit Title: SeaWell Networks Spectrum - Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.seawellnetworks.com/spectrum/ Versions Reported: Spectrum SDC 02.05.00, Build 02.05.00.0016 CVE-ID: CVE-2015-8282 CVE-2015-8283 CVE-2015-8284 About SeaWell Networks Spectru...
CVE-2015-3709: Concurrent Execution using Shared Resource with Improper Synchronization
Race condition in kext tools in Apple OS X before 10.10.4 allows local users to bypass intended signature requirements for kernel extensions by leveraging improper pathname validation...
PT-2015-6461
Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client version 3.160 Description The issue is related to improper pathname validation, allowing local users to gain privileges through a crafted INF file. Recommendations For Cisco AnyConnect Secure Mobility...
Improper access control
The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, which allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory, aka "Microsoft Windows 7 Defender Improper...