Path Traversal

github.com/hoffie/larasync is vulnerable to Path Traversal. The vulnerability exists in multiple functions of filestorage.go which allows an attacker to traverse through the directory path and gain access to sensitive files...

Insecure Temporary File

globalpomutils-fileresources is vulnerable to Insecure Temporary Files. The vulnerability exists due to the File.createTempFile function in the createTmpDir method of FileResourceManagerProvider.java, which creates a temporary directory with default permissions. This directory has READ all...

WordPress Slider Revolution 4.1.3 Directory Traversal

==================================================================================================================================== | Title : WordPress - Slider Revolution 4.1.3 Directory Traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...

PT-2023-14430 · Unknown · B2Evolution

Name of the Vulnerable Software and Affected Versions: b2evolution version 7.2.5 Description: The issue allows for arbitrary file upload, leading to command execution, when configured with admins can manipulate sensitive files. This is considered a feature by the vendor, but it can be exploited b...

S3Crets_Scanner - Hunting For Secrets Uploaded To Public S3 Buckets

S3cret Scanner tool designed to provide a complementary layer for the Amazon S3 Security Best Practices by proactively hunting secrets in public S3 buckets. Can be executed as scheduled task or On-Demand Automation workflow The automation will perform the following actions: 1. List the public...

Privilege Escalation

silverstripe/subsites is vulnerable to privilege escalation. The vulnerability exists in FileSubsites.php due to the lack of validation in file edit privileges, which allows an attacker to modify sensitive files inside the system...

MxsDoc 路径遍历漏洞

MxsDoc is Rainy open source a Web-based document management system . MxsDoc has a security vulnerability. Attackers use this vulnerability to perform incorrect operations to obtain sensitive information in the file directory...

Directory Traversal

Overview std/os is a Go standard library package std/os Affected versions of this package are vulnerable to Directory Traversal. Go Vulnerability Report: On Windows, restricted files can be accessed via os.DirFS and http.Dir.The os.DirFS function and http.Dir type provide access to a tree of file...

Information Disclosure

htsjdk is vulnerable to information disclosure. The vulnerability exists in createTempDir function of IOUtil.java because the information in this directory is visible to other local users which allows an attacker to view sensitive files and hijack the directories to manipulate contents escalating...

CVE-2022-44532

An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files in Aruba EdgeConnect...

PT-2022-27271

Name of the Vulnerable Software and Affected Versions S2W – Import Shopify to WooCommerce plugin version 1.1.12 and earlier Description The issue is related to an Arbitrary File Read vulnerability that affects users with admin+ authentication. This could potentially allow unauthorized access to...

PT-2022-26689 · Atlassian · Netic User Export +1

Name of the Vulnerable Software and Affected Versions: Netic User Export add-on for Atlassian Confluence versions prior to 1.3.5 Description: The issue allows an HTTP request to download any file on the system, including sensitive files like SSH private keys, due to the fileName parameter accepti...

PT-2022-27423 · Unknown · Cbrn-Analysis

Name of the Vulnerable Software and Affected Versions: CBRN-Analysis versions prior to 22 Description: The issue is related to weak file permissions under the Public Profile, which can lead to the disclosure of file contents or privilege escalation. Recommendations: For versions prior to 22, upda...

CVE-2022-41607

All versions of ETIC Telecom Remote Access Server RAS 4.5.0 and prior’s application programmable interface API is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords,...

Directory traversal

All versions of ETIC Telecom Remote Access Server RAS 4.5.0 and prior’s application programmable interface API is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords,...

CVE-2022-41607 ETIC Telecom Remote Access Server Path Traversal

All versions of ETIC Telecom Remote Access Server RAS 4.5.0 and prior’s application programmable interface API is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords,...

CVE-2022-41607 ETIC Telecom Remote Access Server Path Traversal

All versions of ETIC Telecom Remote Access Server RAS 4.5.0 and prior’s application programmable interface API is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords,...

Information Disclosure

tripleo-ansible is vulnerable to information disclosure. A local attacker is able to use brute force to explore important configuration details due to insecure default configurations which allows an attacker to restrict the permissions of the sensitive files...

PT-2022-25982 · Etic Telecom · Etic Telecom Remote Access Server

Name of the Vulnerable Software and Affected Versions: ETIC Telecom Remote Access Server RAS versions 4.5.0 and prior Description: The application programmable interface API of the affected software is vulnerable to directory traversal through several different methods. This could allow an attack...

CVE-2022-44311

html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elmclosetreenodet nodo at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service DoS via a crafted html file...