etcd vulnerable to TOCTOU of gateway endpoint authentication

Vulnerability type Authentication Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates th...

etcd vulnerable to TOCTOU of gateway endpoint authentication

The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates the detected endpoints once...

srvmamatahospital.com Cross Site Scripting vulnerability OBB-2641383

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-1562

Name of the Vulnerable Software and Affected Versions D-Link device DI-7200GV2.E1 version 21.04.09E1 Description The issue is related to a command injection vulnerability in the proxy client.asp file. This vulnerability allows attackers to execute arbitrary commands via the proxy srv, proxy...

Directory Traversal

ftp-srv is vulnerable to directory traversal. The vulnerability exists as it does not perform checks on the relative path to see if it resolves to a path outside of the application root directory...

CVE-2020-26299

ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands,...

@zpmc/zwd-server (>=0.0.14, <=0.0.21) potentially affected by CVE-2020-26299 via ftp-srv (4.1.0)

ftp-srv NPM version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ftp-srv and may be impacted: - @zpmc/zwd-server =0.0.14, =0.0.21 Source cves: CVE-2020-26299 Source advisory: OSV:GHSA-PMW4-JGXX-PCQ9...

CVE-2020-26299

ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands,...

CVE-2020-26299

Summary: CVE-2020-26299 affects the ftp-srv npm package (FTP server) prior to 4.4.0. The root cause is how Windows path separators () interact with path.resolve, leaving an upper pointer intact and allowing a user to move beyond the defined FTP root via commands like CWD/UPDR. Impact: potential p...

PT-2021-11238

Name of the Vulnerable Software and Affected Versions: ftp-srv versions prior to 4.4.0 Description: The issue concerns a path-traversal vulnerability in ftp-srv, an open-source FTP server. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root...

ftp-srv Path Traversal Vulnerability

Connor Skees ftp-srv is an open source application from Connor Skees. Provides a modern and scalable FTP server designed to be simple but configurable. A path traversal vulnerability exists in ftp-srv, which arises from a failure of a network system or product to properly filter special elements ...

CVE-2020-26299: Improper Limitation of a Pathname to a Restricted Directory

ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands,...

dnsrecon 0.10.0 - CSV Injection

Exploit Title: dnsrecon 0.10.0 - CSV Injection Author: Dolev Farhi Date: 2021-01-07 Vendor Homepage: https://github.com/darkoperator/dnsrecon/ Version : 0.10.0 Tested on: ParrotOS 4.10 dnsrecon, when scanning a TXT record such as SPF, i.e.: spf.domain.com, outputs a CSV report -c out.csv with...

dnsrecon 0.10.0 CSV Injection

Exploit Title: dnsrecon 0.10.0 - CSV Injection Author: Dolev Farhi Date: 2021-01-07 Vendor Homepage: https://github.com/darkoperator/dnsrecon/ Version : 0.10.0 Tested on: ParrotOS 4.10 dnsrecon, when scanning a TXT record such as SPF, i.e.: spf.domain.com, outputs a CSV report -c out.csv with...

CVE-2020-35857

An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption...

CVE-2020-35857

An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption...

CVE-2020-35857

An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption...

CVE-2020-35857

The CVE-2020-35857 entry applies to the trust-dns-server crate in Rust, prior to version 0.18.1. The issue arises from how MX and SRV null targets are handled, leading to stack consumption (stack overflow) when processing additional records for MX/SRV targets, potentially causing a crash and DOS....

CVE-2020-35857: Uncontrolled Resource Consumption

An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption...

Server-Side Request Forgery in ftp-srv

All versions of ftp-srv from v1.0.0 onward to v4.3.3 are vulnerable to Server-Side Request Forgery SSRF. The package fails to prevent remote clients to access other resources in the network, for example when connecting to the server through telnet. This allows attackers to access any network...