Directory Traversal

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Directory Traversal via parsedRepoUrl.filepath in confluenceToMarkdown.ts, where...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via validatepath in dulwich/index.py when processing tree entries whose leading path component is a DOS drive-letter prefix e.g., C:. On Windows, os.path.joinroot, b"C:..." discards the work-tree root and resolves to...

Directory Traversal

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which returned the...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the handling of directory listing responses. An attacker can write files outside the intended destination root by crafting object names containing forward slashes and parent directory references. Details A...

Directory Traversal

Overview icecoder/icecoder is a Browser based code editor allowing you to code from anywhere. Affected versions of this package are vulnerable to Directory Traversal via the oldFileName parameter in file move and rename operations. An attacker can access or relocate files outside the intended...

Directory Traversal

Overview mcp-sequential-thinking is an A Sequential Thinking MCP Server for advanced problem solving Affected versions of this package are vulnerable to Directory Traversal in the exportsession process. An attacker can access or modify files outside the intended directory by supplying crafted inp...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper normalization of object keys containing dot-dot segments in the S3 serving process. An attacker can access or modify files outside the intended bucket directory but within the configured serve root by...

Directory Traversal

Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal via the process function. An attacker can access arbitrary files and obtain the first 10 bytes of their contents by supplying a crafted...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file reading process for PRX or STX files. An attacker can cause files to be written to arbitrary locations on the file system by supplying a specially crafted file. Workaround This vulnerability can be...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file reading process for PRX or STX files. An attacker can cause files to be written to arbitrary locations on the file system by supplying a specially crafted file. Workaround This vulnerability can be...

Directory Traversal

Overview composer/composer is a Dependency Manager for PHP. Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere. Affected versions of this package are vulnerable to Directory Traversal via the bin field when it contains .. pa...

Directory Traversal

Overview composer/composer is a Dependency Manager for PHP. Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere. Affected versions of this package are vulnerable to Directory Traversal through improper validation of package...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ScopedFs process. An attacker can create files outside of the intended user scope by exploiting dangling symlinks during file creation when possessing Create and Modify permissions. Details A Directory...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the org.opencontainers.image.title annotation in the artifact manifest when downloading OCI artifacts. An attacker can cause files to be written to arbitrary locations on the host filesystem by supplying a crafte...

Directory Traversal

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Directory Traversal

Overview org.webjars.npm:browserstack-runner is an A command line interface to run browser tests over BrowserStack Affected versions of this package are vulnerable to Directory Traversal via the default handler in the HTTP server. An attacker can access arbitrary files on the host filesystem by...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to shipping two public Twig components — and — that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the Twig |raw filter. Details A...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the validatepathelementntfs function. An attacker can write arbitrary files and potentially execute code in the victim's user context by crafting malicious Git repositories with NTFS-hostile tree entries that are...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to the improper validation of annotations from org.opencontainers.image.title in pullArtifact methods in Registry and OCILayout. An attacker can manipulate this annotation to create a path that escapes the output...

Directory Traversal

Overview zrok is a zrok Affected versions of this package are vulnerable to Directory Traversal due to Alice exposing a Python SDK ProxyShare with a fixed target URL. Bob sends a request to the share with an absolute URL in the path. The Flask handler passes that path to urllib.parse.urljoin, whi...