PT-2021-23903 · Thinkup · Thinkup

Name of the Vulnerable Software and Affected Versions: ThinkUp version 2.0-beta.10 Description: The issue is a path manipulation vulnerability in Smarty.class.php. This vulnerability only affects products that are no longer supported by the maintainer. Recommendations: For ThinkUp version...

Unspecified vulnerability in libretime

Libretime is a radio broadcast and automation platform. libretime is vulnerable due to a naming function vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController. php for path manipulation. No details of the vulnerability are currently available...

CVE-2021-43685

libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename function...

CVE-2021-43685

libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename function...

CVE-2021-43685

libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename function...

Path traversal

libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename function...

CVE-2021-43685

libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename function...

CVE-2021-43685

CVE-2021-43685 affects libretime hv3.0.0-alpha.10 and is linked to a path manipulation vulnerability in ShowImageController.php (legacy module) via the rename function. Connected sources consistently describe a naming/path traversal issue in /blob/master/legacy/application/modules/rest/controller...

Tripexpress path traversal vulnerability

Tripexpress is an open source bus tour travel booking management web application by Shpetim Islami, an Austrian individual developer. tripexpress suffers from a path traversal vulnerability, which originates from the assignment of $SERVERargv assigned to src, the lack of effective filtering and...

libretime 安全漏洞

Libretime is a radio broadcast and automation platform. libretime is vulnerable due to a naming function vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController. php for path manipulation. No details of the vulnerability are currently available...

CVE-2021-43691

tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/loadfont.php. The variable src is coming from $SERVER"argv" then there is a path manipulation vulnerability...

CVE-2021-43691

tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/loadfont.php. The variable src is coming from $SERVER"argv" then there is a path manipulation vulnerability...

CVE-2021-43691

tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/loadfont.php. The variable src is coming from $SERVER"argv" then there is a path manipulation vulnerability...

CVE-2021-43691

Tripexpress v1.1 is affected by a path traversal vulnerability in file system/helpers/dompdf/load_font.php. The issue arises because the variable src is assigned from $_SERVER["argv"] (src coming from argv) and is not properly validated, enabling path manipulation. No remediation or patch details...

Tripexpress 路径遍历漏洞

Tripexpress is an open source bus tour travel booking management web application by Shpetim Islami, an Austrian individual developer. tripexpress suffers from a path traversal vulnerability, which originates from the assignment of $SERVERargv assigned to src, the lack of effective filtering and...

CVE-2021-41152

OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere o...

aurelia path code injection vulnerability

aurelia path is part of the aurelia platform and contains utilities for path operations. A code injection vulnerability exists in aurelia path that exposes Aurelia applications that use the aurelia-path package to parse strings. No detailed vulnerability details are provided at this time...

CVE-2021-41097

aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses aurelia-path package to parse a string. The majority of this will b...

CVE-2021-41097

aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses aurelia-path package to parse a string. The majority of this will b...

SmartFTP Client 10.0.2909.0 - (Multiple) Denial of Service Exploit

Exploit Title: SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service Exploit Author: Eric Salario Vendor Homepage: https://www.smartftp.com/en-us/ Software Link: https://www.smartftp.com/en-us/download Version: 10.0.2909.0 32 and 64 bit Tested on: Microsoft Windows 10 32 bit and 64 bit...