CVE-2020-27385

Incorrect Access Control in the FileEditor /Admin/Views/FileEditor/ in FlexDotnetCMS before v1.5.11 allows an authenticated remote attacker to read and write to existing files outside the web root. The files can be accessed via directory traversal, i.e., by entering a .. dot dot path such as...

CVE-2020-28328

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled .php file under the web root...

CVE-2020-28328

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled .php file under the web root...

Remote code execution

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled .php file under the web root...

CVE-2020-28328

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled .php file under the web root...

Directory Traversal

droppy is vulnerable to directory traversal. Lack of validation allows an attacker to access system files outside of the web root using the ../ characters in the URL...

Design/Logic Flaw

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=managecar because .php files can be uploaded to admin/assets/uploads/ under the web root...

Path Traversal

hnzserver is vulnerable to path traversal. A remote attacker is able to access files and directories outside of the web root by passing ../ character sequences in the URL...

Directory Traversal

hangersteak is vulnerable to directory traversal. Lack of validation of the URL path allows an attacker to traverse out of the web root and access arbitrary system files...

CVE-2020-5916

In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory...

CVE-2020-5916

In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory...

CVE-2020-5916

In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K29923912)

The Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory. CVE-2020-5916 Impact Requests to the Configuration utilitycan result in arbitrary file reads outside of the web root directory. C Tenable Network Security, Inc...

Path Traversal in simbco/httpster

Description I would like to report a Path Traversal vulnerability in the httpster module. It allows an attacker to read system files via a Path Traversal vulnerability. With a symbolically linked file in the working directory, it is possible to read arbitrary files outside of the web root...

Directory Traversal

fast-http is vulnerable to directory traversal. Lack of path sanitization in the fs.readfile function in index.js allows an attacker to access arbitrary files outside of the web root...

CVE-2020-11440

httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root...

Code injection

httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root...

CVE-2020-11440

CVE-2020-11440 describes a vulnerability in Wind River VxWorks (WebCLI) where httpRpmFs fails to validate escaping attempts from the web root, potentially exposing sensitive data. The NVD entry notes a network-based attack surface with a CVSS v3.1 base score of 7.5 (High) and a CVSS v2 base score...

Directory Traversal

jooby is vulnerable to directory traversal. Lack of path validation allows an attacker to inject ../ characters and access files outside of the web root directory...

TeamPass Injection Vulnerability

TeamPass is an open source password manager from the developers of NILS LAUMAILL? software. A security vulnerability exists in TeamPass version 2.1.27.36. An attacker can exploit this vulnerability to retrieve files including backup files or LDAP debug files in the TeamPass web root directory...