CVE-2020-25176: Relative Path Traversal

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer IXL protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated...

Yokogawa CENTUM and Exaopc Relative Path Traversal (CVE-2022-22729)

CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to...

CVE-2022-21808: Relative Path Traversal

Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.0...

CVE-2021-35380

A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server TTServer 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to download http://url:port/file?valore...

GHSA-RPX7-33J2-XX9X Arbitrary file deletion in NeMo ASR webapp

Description NVIDIA NeMo contains a vulnerability in ASR WebApp, where Relative Path Traversal CWE-23 may lead to deletion of any directory through the "../" structure when admin privileges are available. CVSS Score = 2.0...

Arbitrary file deletion in NeMo ASR webapp

Description NVIDIA NeMo contains a vulnerability in ASR WebApp, where Relative Path Traversal CWE-23 may lead to deletion of any directory through the "../" structure when admin privileges are available. CVSS Score = 2.0...

Beckhoff TwinCAT OPC UA Server Path Traversal (CVE-2021-34594)

TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system. This plugin only works with Tenable.ot. Please visit...

Mageia: Security Advisory (MGASA-2021-0267)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Open Redirect in node-forge

parseUrl functionality in node-forge mishandles certain uses of backslash such as https:///\ and interprets the URI as a relative path...

CVE-2021-37196: Relative Path Traversal

A vulnerability has been identified in COMOS V10.2 All versions only if web components are used, COMOS V10.3 All versions = V10.3.3.3 only if web components are used, COMOS V10.4 All versions V10.4.1 only if web components are used. The COMOS Web component of COMOS unpacks specially crafted archi...

SUSE-SU-2022:0029-1 Security update for python-Babel

This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal leading to loading arbitrary locale files on disk and executing arbitrary code bsc1185768...

SUSE-SU-2021:4161-1 Security update for python-Babel

This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal that may lead to arbitrary locale files loading and arbitrary code execution bsc1185768...

The vulnerability of the TwinCAT OPC UA Server lies in errors in processing the relative path to the directory. This allows attackers to create and delete arbitrary files within the system.

The vulnerability of the TwinCAT OPC UA Server is related to errors in processing the relative path to the directory. Exploiting this vulnerability allows a malicious actor to create and delete arbitrary files within the system...

Security update for python-Babel (important)

openSUSE Security Update: Security update for python-Babel Announcement ID: openSUSE-SU-2021:1553-1 Rating: important References: 1185768 Cross-References: CVE-2021-42771 CVSS scores: CVE-2021-42771 SUSE: 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 An...

CVE-2021-41024

A relative path traversal CWE-23 vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page...

CVE-2021-20040

A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances...

Path traversal

A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances...

CVE-2021-20040: Relative Path Traversal

A relative path traversal vulnerability in the SMA100 upload funtion allows a remote unauthenticated attacker to upload crafted web pages or files as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances...

CVE-2021-43176: Relative Path Traversal

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the...

Protect

A relative path traversal CWE-23 vulnerabiltiy in FortiOS and FortiProxy may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page...