691 matches found
CVE-2022-25937
Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in CVE-2018-3715...
The vulnerability of the CachingResourceDownloadRewriteRule implementation in the Jira bug tracking system allows a hacker to access files in the root directory.
The vulnerability of the CachingResourceDownloadRewriteRule implementation in the Jira bug tracking system is related to an incorrect limitation on the path to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain access to files in the root director...
CVE-2022-43514
A vulnerability has been identified in Automation License Manager V5 All versions, Automation License Manager V6 All versions V6.0 SP9 Upd4, TeleControl Server Basic V3 All versions V3.1.2. The affected component does not correctly validate the root path on folder related operations, allowing to...
CVE-2022-25848
This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory...
CVE-2022-25848
This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory...
CVE-2022-25848 Directory Traversal
This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory...
CVE-2022-25848 Directory Traversal
This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory...
FusionAuth 路径遍历漏洞
FusionAuth is FusionAuth open source a best-of-breed authentication solution built for developers. A security vulnerability exists in versions prior to FusionAuth 1.41.3 that stems from allowing files outside of the application root directory to be viewed or retrieved using HTTP requests...
Unauthorized access to settings update, logs , history, delete etc of repositories
Hey, Attack Scenario: Admin setups new user with User privileges and gives access to repos "/" root directory, after a time due to some reason he revoke the privileges of the directory access but user privileged attacker can still edit settings , check logs and view history without having...
PT-2022-23818 · Unknown · Patrickfuller Camp
Name of the Vulnerable Software and Affected Versions: patrickfuller camp versions up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 Description: The issue concerns Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root director...
Samba 后置链接漏洞
Samba is the standard Windows interoperability program suite for Linux and Unix. A security vulnerability exists in Samba. An attacker could use this vulnerability to read or modify files located outside of the shared root directory...
Zimbra Collaboration Suite Remote Code Execution Vulnerability
Zimbra Collaboration Suite ZCS is an open source collaborative office suite. The product includes WebMail, Calendar, Address Book, etc. A security vulnerability exists in Zimbra Collaboration Suite ZCS versions 8.8.15 and 9.0, which stems from a lack of valid authentication of uploaded files by t...
Denial Of Service (DoS)
rdiffweb is vulnerable to denial of service. The vulnerability exists in pageadmin.py due to not limiting the length of root directory name which allows an attacker to cause an application crash via a malicious input...
rdiffweb allows unlimited length of root directory name, which could result in DoS
rdiffweb prior to 2.4.8 has no limit in length of root directory names. Allowing users to enter long strings may result in a DOS attack or memory corruption. Version 2.4.8 defines a field limit for username, email, and root directory...
GHSA-HRJ7-F62F-J7X7 rdiffweb allows unlimited length of root directory name, which could result in DoS
rdiffweb prior to 2.4.8 has no limit in length of root directory names. Allowing users to enter long strings may result in a DOS attack or memory corruption. Version 2.4.8 defines a field limit for username, email, and root directory...
PT-2022-21436 · Rdiffweb · Rdiffweb
Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.8 Description: The issue arises from improper handling of length parameter inconsistency, specifically in the validation of email length. This allows users to insert an email longer than 255 characters. If a use...
PT-2022-10744
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to...
CVE-2021-42052
IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and the R query parameter...
