Directory Traversal

ioBroker.js-controller is vulnerable to directory traversal. An attacker is able to include file contents from outside of the /adapter/ directory via the administrative web panel using a request for an adapter file containing the ../ characters in the file name. Authentication is not enabled by...

CVE-2019-10767

An attacker can include file contents from outside the /adapter/xxx/ directory, where xxx is the name of an existent adapter like "admin". It is exploited using the administrative web panel with a request for an adapter file. Note: The attacker has to be logged in if the authentication is enabled...