1336 matches found
GHSA-JP57-4X34-5V94 Mattermost Server is vulnerable to webhook and slash command manipulation
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...
Mattermost Server is vulnerable to webhook and slash command manipulation
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...
GHSA-WVJG-33P9-938H Mattermost Server does not properly restrict use of slash commands
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...
Mattermost Server does not properly restrict use of slash commands
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...
Symfony Directory Traversal
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...
Directory Traversal
Overview mixlib-archive is a simple interface to various archive formats Affected versions of this package are vulnerable to Directory Traversal allowing attackers to overwrite arbitrary files by supplying a filename for a tar archive involving ... Details A Directory Traversal attack also known ...
GHSA-4JJW-XRR6-9V3P Mortbay Jetty Double Slash URI Information Disclosure Vulnerability
Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple / slash characters in the URI...
Exploit for Unrestricted Upload of File with Dangerous Type in Intelliants Subrion_Cms
SubrionCMS-4.2.1-File-upload-RCE-auth- This is an edited versi...
CVE-2022-28380
The rc-httpd component through 2022-03-31 for 9front Plan 9 fork allows ..%2f directory traversal if serve-static is used...
Path Traversal due to `send_file` call
A path traversal attack also known as directory traversal aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash ../” sequences and its variations or by using absolute file paths, it may be possible to...
CVE-2022-23317
CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...
CVE-2022-23317
CobaltStrike =4.5 HTTPS listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL...
PT-2022-15924 · Unknown · Cobalt Strike
Name of the Vulnerable Software and Affected Versions: CobaltStrike versions prior to 4.6 Description: The issue concerns the HTTPS listener in CobaltStrike, which fails to verify if the request URL starts with a forward slash /. This oversight allows attackers to gather sensitive information by...
CVE-2022-0011
PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed depending on your rules regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list EDL i...
CVE-2022-0011
PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed depending on your rules regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list EDL i...
UBUNTU-CVE-2021-32842
SharpZipLib or ziplib is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that baseDirectory ends with slash. If the baseDirectory is not slash terminated...
SharpZipLib 路径遍历漏洞
SharpZipLib ziplib, formerly known as NZipLib is an open source C compression and decompression library from the ICSharpCode Icsharpcode team for the .NET platform, which supports decompression and compression of Zip, GZip, BZip2, Tar and other formats. SharpZipLib has a security vulnerability th...
The vulnerability of the Node.js module for processing tar archives using Node-tar lies in the shortcomings of the pathname limitation, which allows attackers to compromise the integrity of the data and cause service failures.
The vulnerability of the Node.js module for processing tar archives using Node-tar is related to improper filtering of the '/' character sequence. Exploiting this vulnerability can allow an attacker to compromise data integrity and cause service failures...
