Design/Logic Flaw

IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view or write to arbitrary files on the system. IBM X-Force ID: 228579...

CVE-2022-33164 IBM Security Directory Server path traversal

IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view or write to arbitrary files on the system. IBM X-Force ID: 228579...

PT-2023-13233 · Ibm · Ibm Security Directory Server

Name of the Vulnerable Software and Affected Versions: IBM Security Directory Server version 7.2.0 Description: The issue allows a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view or write to...

HashiCorp Terraform Path Traversal Vulnerability

HashiCorp Terraform is an open source tool for provisioning and managing cloud infrastructure from HashiCorp, USA. A security vulnerability exists in Terraform versions 1.0.8 through 1.5.6, which stems from allowing arbitrary files to be written during an init operation...

CVE-2023-20193

A vulnerability in the Embedded Service Router ESR of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate their privileges to root. To exploit this vulnerability, an attacker must have valid...

CVE-2023-20194

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This...

The vulnerability of the online business analytics service IBM Cognos Analytics, which stems from the lack of restrictions on file uploads, allows a perpetrator to upload arbitrary files.

The vulnerability of the online business analytics service IBM Cognos Analytics lies in the lack of restrictions on file uploads. Exploiting this vulnerability allows a malicious actor to upload any files they desire remotely...

Oracle Linux 7 : zziplib (ELSA-2020-1178)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1178 advisory. 0.13.62-12 - Fix a directory traversal bug - unzip-mem should now strip all '../' prefixes from the archived files - Resolves: CVE-2018-17828 Tenable has...

WordPress Advanced File Manager Plugin < 5.1.1 Broken Access Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:advancedfilemanager:advancedfilemanager"; ifdescription...

Cisco Identity Services Engine Security Vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The ISE collects real-time information from the network, users, and devices to develop and implement policies to monitor the network. A security vulnerability exists in the Cisco Identity...

CVE-2023-30707

Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attackers to delete arbitrary files with Samsung Keyboard privilege...

Input validation

Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attackers to delete arbitrary files with Samsung Keyboard privilege...

CVE-2023-30707

Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attackers to delete arbitrary files with Samsung Keyboard privilege...

CVE-2023-30707

Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attackers to delete arbitrary files with Samsung Keyboard privilege...

CVE-2023-2453

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known...

Path traversal

Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on the server, resulting in arbitrary code execution...

CVE-2023-39448

Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on the server, resulting in arbitrary code execution...

PT-2023-22906 · Samsung · Samsung Keyboard

Name of the Vulnerable Software and Affected Versions: Samsung Keyboard versions prior to SMR Sep-2023 Release 1 Description: The issue is related to improper authorization, allowing an attacker to read arbitrary files with system privilege. Recommendations: For versions prior to SMR Sep-2023...

PT-2023-22930 · Unknown · Packageinstallerchn

Name of the Vulnerable Software and Affected Versions: PackageInstallerCHN versions prior to 13.1.03.00 Description: The issue allows a local attacker to access arbitrary files due to an intent redirection vulnerability. This vulnerability requires user interaction. Recommendations: For versions...

WordPress plugin Advanced File Manager Access Control Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. An Access Control Error vulnerability previously existed...