2172 matches found
CVE-2021-43798-Exploit-for-Windows-and-Linux
CVE-2021-43798-Exploit-for-Windows-and-Linux 针对 CVE-2021-43798 的修改版利用程序。 原始利用代码：https://www.exploit-db.com/exploits/50581 修改内容： 此修改版本兼容 Windows 和 Linux 底层服务器。 当用户输入绝对路径时（例如：C:\Windows\System32\drivers\etc\hosts），程序会将其转换为相对路径（Windows\System32\drivers\etc\hosts）。...
CVE-2025-46822
CVE-2025-46822 未经验证的任意文件读取（通过绝对路径） 描述： 尽管 Path.resolve 方法被用来防止路径遍历，但我发现使用绝对路径成功读取了内部文件。该端点也未经过身份验证，这意味着任何人都可以读取整个组织的文件，从配置文件 application-dev.properties 中设置的存储根目录 files.store.root = /file-store/ 开始的文件系统。这允许未经授权访问敏感的内部文件。 详细信息： storageService.loadAsResource 方法使用了...
Gradio - Absolute Path Traversal
Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...
LOLLMS WebUI - Absolute Path Traversal
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the openfile endpoint of lollmsadvanced.py. The sanitizepath function with allowabsolutepath=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can...
Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download
The File Download API in Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data. id: CVE-2021-38146 info: name: Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Downloa...
rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options
A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...
CVE-2025-70820
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...
EUVD-2025-210899
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...
CVE-2025-70820
Zettlab D6 Ultra (a NAS device) prior to firmware 1.7.0 is affected by an absolute path traversal vulnerability that allows an attacker with low privileges on an adjacent network to reach folders outside the user's personal folder, resulting in low confidentiality impact (CVSS 3.5, LOW). The reme...
CVE-2020-13941
CVE-2020-13941: Abuso de rutas UNC en entornos Windows en Apache Solr Se ha descubierto que múltiples endpoints de Solr aceptan rutas absolutas. En sistemas Windows, estas rutas absolutas pueden ser forzadas para hacer que el sistema operativo se conecte a un servidor SMB controlado por el...
EUVD-2026-75770
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...
CVE-2026-82092
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...
CVE-2026-81554
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...
CVE-2026-45767
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some...
CVE-2026-81554
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability (CWE-22). According to IBM's security bulletin, this CVE is part of a group of vulnerabilities introduced through open source pac...
CVE-2026-82092 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...
CVE-2026-82092
IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an absolute-path traversal vulnerability that allows a remote, authenticated attacker to obtain sensitive information. The IBM-assigned CVSS 3.1 score is 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high imp...
CVE-2026-69612
Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally...