CVE-2017-9664: Relative Path Traversal

In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal files of ABB SREA-01 and SREA-50 legacy remote monitoring tools without any authorization over the network using a HTTP request which...

Path Traversal

Overview Versions of resolve-path before 1.4.0 are vulnerable to path traversal. resolve-path relative path resolving suffers from a lack of file path sanitization for windows based paths. Recommendation Update to version 1.4.0 or later. References - HackerOne Report - GitHub Advisory...

Medtronic 2090 Carelink Programmer Vulnerabilities (Update C)

1. EXECUTIVE SUMMARY CVSS v3 7.1 Vendor: Medtronic Equipment: 2090 CareLink Programmer, 29901 Encore Programmer Vulnerabilities: Storing Passwords in a Recoverable Format, Relative Path Traversal, Improper Restriction of Communication Channel to Intended Endpoints 2. UPDATE INFORMATION This...

CVE-2018-6356: Improper Limitation of a Pathname to a Restricted Directory

Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On...

UBUNTU-CVE-2017-17042

lib/yard/coreext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files...

PT-2017-14678 · Yard +3 · Yard +3

Name of the Vulnerable Software and Affected Versions: YARD versions prior to 0.9.11 Description: The issue allows attackers to conduct directory traversal attacks and read arbitrary files due to the failure to block relative paths with an initial ../ sequence in the lib/yard/core ext/file.rb fil...

CVE-2017-8137

HedEx Earlier than V200R006C00 versions has a dynamic link library DLL hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking...

CVE-2017-8137

HedEx Earlier than V200R006C00 versions has a dynamic link library DLL hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking...

PT-2017-18146

Name of the Vulnerable Software and Affected Versions HedEx versions earlier than V200R006C00 Description The issue is related to a dynamic link library DLL hijacking vulnerability. This occurs because the software calls a DLL file by accessing a relative path, allowing an attacker to potentially...

CVE-2017-8137: Untrusted Search Path

HedEx Earlier than V200R006C00 versions has a dynamic link library DLL hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking...

CVE-2017-13996

A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code...

CVE-2017-13996

A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code...

CVE-2017-13996

CVE-2017-13996 affects LOYTEC LVIS-3ME web UI prior to firmware 6.2.0. The vulnerability is a Relative Path Traversal in the LVIS-3ME interface, which can allow access to sensitive files and potentially enable an attacker to create/modify files or execute arbitrary code. Affected product: LVIS-3M...

PT-2017-13190

Name of the Vulnerable Software and Affected Versions LOYTEC LVIS-3ME versions prior to 6.2.0 Description A Relative Path Traversal issue was discovered in the web user interface, which fails to prevent access to critical files that non-administrative users should not have access to. This could...

CVE-2017-13996: Relative Path Traversal

A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code...

LOYTEC LVIS-3ME Relative Path Traversal Vulnerability

LVIS-3ME is a graphical user interface from LOYTEC. A relative path traversal vulnerability exists in LOYTEC LVIS-3ME versions prior to 6.2.0, which can be exploited by an attacker to create or modify files, or execute arbitrary code, due to the inability of the web user interface to prevent user...

Cross-Site Scripting (XSS)

Phpbb is vulnerable to cross-site scripting XSS attacks. The attacks are possible because includes/startup.php does not sanitize the user-supplied input which allows trailing paths to be injected through "Relative Path Overwrite."...

Path traversal

A vulnerability in the AutoVNF VNFStagingView class of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to execute a relative path traversal attack, enabling an attacker to read sensitive files on the system. More Information: CSCvc76662. Known Affected Releases:...

CVE-2017-6681

The CVE-2017-6681 vulnerability affects Cisco Ultra Services Framework (USF) AutoVNF VNFStagingView, specifically a flaw in URL handling that allows a remote, unauthenticated attacker to perform a relative path traversal and read sensitive files. Affected release is Cisco USF version 21.0.0. The ...

PT-2017-17239

Name of the Vulnerable Software and Affected Versions Cisco Ultra Services Framework version 21.0.0 Description A vulnerability in the AutoVNF VNFStagingView class could allow an unauthenticated, remote attacker to execute a relative path traversal attack, enabling the attacker to read sensitive...