Spring Web multipart file rewrite

The vulnerability of the org.springframework.web.multipart package in the Spring Web framework is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to re-upload files stored in the web server’s directory from a...

WPLMS Training Management System Data Access

The vulnerability of the WPLMS training management system involves incorrect restrictions on the path to the restricted access catalog. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

CMSimple Path Traversal Unauthorized Access

The vulnerability of the CMSimple content management system is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending a specially crafted GET request...

Fortinet FortiManager Path Traversal

The vulnerability of the Fortinet FortiManager software for centralized device management, as well as the FortiAnalyzer and FortiAnalyzer-BigData security monitoring and analysis tools, is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this...

TrueNAS CORE tarfile.extractall Code Execution

The vulnerability of the tarfile.extractall method in the TrueNAS CORE operating system is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Ivanti EPM Path Traversal

The vulnerability of the Ivanti EPM endpoint management software is related to incorrect restrictions on path names in the catalog. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Ivanti EPM Path Traversal

The vulnerability of the Ivanti EPM endpoint management software is related to incorrect restrictions on path names in the catalog. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Gogs Arbitrary File Write

The vulnerability of the Gogs self-managed Git repository creation software interface is related to improper restrictions on the path name to the restricted-access directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to write arbitrary files...

ColdFusion Path Traversal

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on path names in the restricted access catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Archive Extraction Handler Luigi Code Execution

The vulnerability of the Archive Extraction Handler component in the Luigi library for the Python programming language is related to an incorrect limitation on the path name of the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using ...

Apache Struts Code Execution

The vulnerability of the File Upload mechanism in the Apache Struts software platform is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code, provided that a specially crafted malicious file is...

Instant AOS-8/AOS-10 CLI Unauthorized Access

The vulnerability of the command-line interface CLI of the Instant AOS-8 and AOS-10 operating systems is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized acces...

Kanboard Path Traversal

The vulnerability of Kanboard project management software is related to incorrect restrictions on the path to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to remotely read and delete any files from the server...

Wowza Streaming Engine XML File Write

The vulnerability of the Manager component in the Wowza Streaming Engine server software is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain access to the XML file in any arbitrary directory...

Wowza Streaming Engine Manager Directory Deletion

The vulnerability of the Manager component in the Wowza Streaming Engine server software is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain access and delete directories, provided that the target...

Moodle Path Traversal Confidential Data

The vulnerability in the virtual training environment Moodle is related to the local loading of files during the restoration of incorrect backup copies of modules. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential data...

Ivanti Endpoint Manager Path Traversal

The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Podman Path Traversal DoS

The vulnerability of the Podman software for managing and starting OCI containers is related to improper restrictions on the path name of a limited catalog. Exploiting this vulnerability allows an attacker who operates remotely to trigger a service failure by using a specially created symbolic li...

Fortinet FortiManager and Fortinet FortiAnalyzer: Path traversal vulnerabilities

Fortinet FortiManager and Fortinet FortiAnalyzer are both products of Fortinet, a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains ADOM to further simplify the...

Python Interpreter Code Execution

The vulnerability of the python38.pth file of the Python interpreter involves ignoring the restrictions specified in the python38.pth file within sys.path. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...