Design/Logic Flaw

An attacker may be able to use minify route with a relative path to view any file on the Cassia Networks Access Controller prior to 2.0.1...

SUSE-SU-2022:3590-1 Security update for python-Babel

This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal bsc1185768...

Dotnetnuke < 9.11.0 Relative Path Traversal

A directory traversal vulnerability exists in DotNetNuke due to insufficient sanitization of user controlled data. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal characters, to disclose the contents of files located outside of the server's...

Arbitrary File Write

Jenkins Pipeline is vulnerable to Arbitrary File Write. The vulnerability exists because of using parameter name without sanitization as a relative path inside a build-related directory which allows an attacker to configure Pipelines to create or replace arbitrary files on the Jenkins controller...

GHSA-9W72-2F23-57GM DNN vulnerable to Relative Path Traversal

DNN GitHub repository dnnsoftware/dnn.platform prior to 9.11.0 is vulnerable to Relative Path Traversal. Version 9.11.0 contains a patch for this issue...

CVE-2022-2922 Relative Path Traversal in dnnsoftware/dnn.platform

Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0...

CVE-2022-2922 Relative Path Traversal in dnnsoftware/dnn.platform

Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0...

CVE-2022-2922

CVE-2022-2922 describes a Relative Path Traversal in the DotNetNuke/DNN platform (GitHub: dnnsoftware/dnn.platform) up to version 9.11.0 . The vulnerability arises from insufficient sanitization of user-controlled input, enabling an authenticated, remote attacker to craft a URI containing directo...

PT-2022-19472 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN versions prior to 9.11.0 Description: The issue is related to Relative Path Traversal. Version 9.11.0 contains a patch for this issue. Recommendations: For versions prior to 9.11.0, update to version 9.11.0 to resolve the issue...

GLSA-202209-26 : Go: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202209-26 Go: Multiple Vulnerabilities - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal...

CVE-2022-28814

Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device...

CVE-2022-40713

CVE-2022-40713 affects NOKIA 1350OMS R14.2. Multiple Relative Path Traversal flaws exist in different endpoints via the file parameter, allowing a remote authenticated attacker to read arbitrary files on the filesystem. The NVD/NVD-derived CVSSv3.1 metrics show a base score of 6.5 (Medium) with N...

CVE-2022-40713

An issue was discovered in NOKIA 1350OMS R14.2. Multiple Relative Path Traversal issues exist in different specific endpoints via the file parameter, allowing a remote authenticated attacker to read files on the filesystem arbitrarily...

CVE-2022-32190

CVE-2022-32190 affects Go’s path.JoinPath and URL.JoinPath, where ../ path elements appended to a relative path are not removed, enabling path-traversal-like behavior. Affected: Golang Go (standard library functions JoinPath/URL.JoinPath). Root cause: ../ components are not stripped from results ...

CVE-2022-32190 Failure to strip relative path components in net/url

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath"https://go.dev", "../go" returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result...

InTouch Access Anywhere Secure Gateway 2020 R2 Path Traversal

Title: ====== AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal Author: ======= Jens Regel, CRISEC IT-Security CVE: ==== CVE-2022-23854 Advisory: ========= https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal/ Timeline: ========= 25.06.2021...

InTouch Access Anywhere Secure Gateway 2020 R2 Path Traversal Vulnerability

Title: ====== AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal Author: ======= Jens Regel, CRISEC IT-Security CVE: ==== CVE-2022-23854 Advisory: ========= https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal/ Timeline: ========= 25.06.2021...

CVE-2022-29062

Multiple relative path traversal vulnerabilities CWE-23 in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests...

Remote Code Execution

dcmtk is vulnerable to remote code execution. Service class users are vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names resulting in remote code execution...

CVE-2022-34378

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3, contain a relative path traversal vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to denial of service...