Path Traversal

NATS nats-server is vulnerable to Path Traversal. The vulnerability is caused by a missing validation check while constructing filenames for account synchronization, which happens in the system account, allowing arbitrary file write as the user running NATS by anyone who can publish arbitrary...

GHSA-VPJC-4JCV-JC29 NATS nats-server allows directory traversal via unintended path to a management action

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

NATS nats-server allows directory traversal via unintended path to a management action

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

CVE-2022-28357

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

CVE-2022-28357

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

UBUNTU-CVE-2022-28357

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

Directory traversal

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

Nats-Server Path Traversal Vulnerability

Nats-Server is a high-performance server for Nats.io, cloud and edge native messaging systems. A path traversal vulnerability exists in Nats-Server versions 2.2.0 through 2.7.4, which stems from a path from an administrative account to an administrative operation that is not as expected...

CVE-2022-28357

CVE-2022-28357 affects NATS nats-server; versions 2.2.0–2.7.4 allow directory traversal via an unintended path to a management action from a management account. Connected sources (OSV, NVD, GHSA, Fedora/Nessus/OpenVAS) corroborate the issue. The impact is described as directory traversal, with hi...

CVE-2022-28357

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

CVE-2022-28357

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

CVE-2022-28357

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

CVE-2022-28357

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

CVE-2022-28357: Improper Limitation of a Pathname to a Restricted Directory

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

CVE-2022-28357

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account...

PT-2023-12941 · Nats · Nats Nats-Server

Name of the Vulnerable Software and Affected Versions: NATS nats-server versions 2.2.0 through 2.7.4 Description: The issue allows directory traversal due to an unintended path to a management action from a management account. This is caused by an unintended path in the management account of the...

GHSA-WVC4-J7G5-4F79 NATS TLS certificate common name validation bypass

The NATS official Rust clients are vulnerable to MitM when using TLS. A fix for the nats crate hasn't been released yet. Since the nats crate is going to be deprecated anyway, consider switching to async-nats = 0.29 which already fixed this vulnerability. The common name of the server's TLS...

NATS TLS certificate common name validation bypass

The NATS official Rust clients are vulnerable to MitM when using TLS. A fix for the nats crate hasn't been released yet. Since the nats crate is going to be deprecated anyway, consider switching to async-nats = 0.29 which already fixed this vulnerability. The common name of the server's TLS...

amts-prelude (>=0.2.2, <=0.2.4), async-nats (>=0.9.0, <=0.10.1) +36 more potentially affected by unknown CVE via nats (>=0.9.18, <=0.23.1)

nats CARGO version =0.9.18, =0.2.2, =0.9.0, =0.6.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.17.0, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.0.1, =0.1.0, =0.6.0-beta.1, =0.9.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WVC4-J7G5-4F79...

core-lib (>=0.1.0, <=0.2.0), eventsourced-nats (>=0.1.0, <=0.6.0) +26 more potentially affected by unknown CVE via async-nats (>=0.9.18, <=0.21.0)

async-nats CARGO version =0.9.18, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.26.0, =0.25.0, =0.1.0, =0.12.0-alpha.1, =0.9.0, =0.16.0, =0.21.0 - wasmcloud-example-runner 0.4.0 - wasmcloud-examples-payments 0.4.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F5V5-CCQC-6W36...