GLPI Path Traversal Phishing

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes is related to incorrect restrictions on the path to the restricted access catalog when processing URL parameters. Exploiting this vulnerability allows a malicious actor to carry out...

PaperCut MF static-content-files Unauthorized Access

The vulnerability of the “static-content-files” component in the PaperCut MF and PaperCut NG software for managing print infrastructure is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability could allow an attacker operating remotely to gain...

Titan SFTP MFT NextGen Path Traversal

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to write files to any location within the file system...

Titan SFTP MFT NextGen Path Traversal

The vulnerability of the Titan SFTP and Titan MFT NextGen server software lies in improper restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to remotely read arbitrary files from the file system...

Avalanche device management system Path Traversal

The vulnerability of the Avalanche device management system is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

FortiSandbox Path Traversal DoS

The vulnerability of the FortiSandbox threat detection and mitigation system is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to cause service failures...

ArubaOS Command Line File Deletion

The vulnerability of the command-line interface of ArubaOS systems is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability allows a malicious actor to delete any files remotely...

LG Simple Editor makeDetailContent Code Execution

The vulnerability of the makeDetailContent method in the LG Simple Editor’s content creation/distribution software lies in improper restrictions on the path to the restricted directory. Exploiting this vulnerability could allow an attacker to enhance their privileges and execute arbitrary code...

Red Hat Ansible Path Traversal

The vulnerability of the Red Hat Ansible configuration management system lies in incorrect restrictions on the path to the restricted access directory. Exploiting this vulnerability could allow an attacker to re-record arbitrary files...

MAGLINK LX Web Console Path Traversal

The vulnerability of the MAGLINK LX Web Console, which manages fuel tanks, is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain access to system files remotely...

Airflow Name Path Restriction Information Disclosure

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scenarios in Airflow is related to deficiencies in path name restrictions. Exploiting this vulnerability can allow attackers to access confidential information using the runid parameter...

ProSafe Network Management System ZipUtils Code Execution

The vulnerability of the ZipUtils class in the ProSafe Network Management NMS300 system, which is used for managing, diagnosing, and optimizing the operation of network devices, is related to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability allows...

Zoom Desktop software Path Traversal Privilege Escalation

The vulnerability of the Zoom Desktop video conferencing software for Windows clients is related to an incorrect limitation on the path to the restricted access directory. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

SCADA Data Gateway Path Traversal

The vulnerability of the SCADA system SCADA Data Gateway SDG is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability allows an attacker to create or delete arbitrary files under the administrator’s name...

Terrasoft CRM ConnectionStrings.config Unauthorized Access

The vulnerability of the ConnectionStrings.config component in the “Terrasoft” CRM system and the “Creatio” BPM system is related to incorrect restrictions on the path to the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain...

FortiExtender Command Line Unauthorized Access

The vulnerability of the command-line interface of the FortiExtender signal booster software is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protecte...

SonicWall Analytics Path Traversal

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System’s global network gateways exists due to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability allows a malicious actor to read arbitrary...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass. Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions. Workaround 1 Enabling the Unattended Install feature will mean the vulnerability is not exploitable. 2...

PT-2023-25870 · Umbraco · Umbraco

Name of the Vulnerable Software and Affected Versions: Umbraco versions prior to 10.6.1 Umbraco versions prior to 11.4.2 Umbraco versions prior to 12.0.1 Description: Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions, potentially leading to...

D-View 8 Network Device Management Platform TftpSendFileThread Disclosure

The vulnerability of the TftpSendFileThread component in the D-View 8 network device management platform is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a remote attacker to disclose the protected information...