CVE-2022-51025

Penta Security WAPPLES versions 4.0.54.1 , 5.0 , and 6.0 are affected by a path traversal vulnerability in the /webapi/file/transfer endpoint. Authenticated attackers can exploit the name parameter by using ../ sequences and the type=db_backup parameter to download arbitrary files, such as /etc/p...

CVE-2022-51025 Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=dbbackup and ../ sequences in name to read files like...

EUVD-2022-56069

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=dbbackup and ../ sequences in name to read files like...

CVE-2022-51025 Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=dbbackup and ../ sequences in name to read files like...

CVE-2022-51025 Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=dbbackup and ../ sequences in name to read files like...

EUVD-2026-107576

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

Progress MOVEit Transfer SQL Injection

Progress MOVEit Transfer contains an unauthenticated SQL injection vulnerability that could allow unauthorized access to database information and exposure of sensitive data...

VulnCheck KEV: CVE-2022-51025

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=dbbackup and ../ sequences in name to read files like...

Linux Distros Unpatched Vulnerability : CVE-2026-111816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out...

Linux Distros Unpatched Vulnerability : CVE-2026-111809

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer- Encoding. This issue affects Apache Traffic Server: from...

CVE-2022-51025: Improper Limitation of a Pathname to a Restricted Directory

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=dbbackup and ../ sequences in name to read files like...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142489)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142489 advisory. In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DM...

Linux Distros Unpatched Vulnerability : CVE-2026-111817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed proxy.config.http.dropchunkedtrailers until the connection...

openSUSE 16 Security Update : tinyproxy (openSUSE-SU-2026:22133-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22133-1 advisory. Changes in tinyproxy: - Fixed failure to reconcile conflicting Content-Length and Transfer-Encoding boo1268474, CVE-2026-54387 - Fixed failure t...

DEBIAN-CVE-2026-94140

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

CVE-2026-94140

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

CVE-2026-94140

Rex versions through 1.16.1 for Perl are vulnerable to an issue where they accept an unknown SSH host key during remote rsync transfers. The root cause is that the sync command hardcodes StrictHostKeyChecking=no , and user-defined options via set_openssh_opt do not override this specific command....