UBUNTU-CVE-2022-26661

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

PYSEC-2022-43170

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

Tryton 代码问题漏洞

Tryton is a content management system. Tryton Application Platform Server versions 5.x through 5.0.45, 6.x through 6.0.15, 6.1.x, 6.2.x through 6.2.5 and Tryton Application Platform Command Line An attacker can utilize an XML SEPA file to access arbitrary files on the system...

Aternity SteelCentral AppInternals 路径遍历漏洞

Aternity SteelCentral AppInternals is a monitoring modern automation solution from Aternity, Inc. A directory traversal vulnerability exists in Aternity SteelCentral AppInternals, which stems from /api/appInternals/1.0/agent/da/pcf that does not perform any validation of user input that allows...

Aternity SteelCentral AppInternals 路径遍历漏洞

Aternity SteelCentral AppInternals is a monitoring modern automation solution from Aternity, Inc. A directory traversal vulnerability exists in Aternity SteelCentral AppInternals, which stems from the fact that /api/appInternals/1.0/plugin/pmx does not perform any validation of user input that...

CVE-2021-24825 Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI

The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ v 4.0.1 or Admin+ v 4.0.2 users to display arbitrary files from the filesystem such as logs, .htaccess etc, as well as perform Local File Inclusion...

PT-2022-15703 · Overit · Overit Geocall

Name of the Vulnerable Software and Affected Versions: OverIT Geocall versions prior to 8.0 Description: An issue was discovered that allows an authenticated user with the Test Trasformazione XSL functionality enabled to exploit a vulnerability. This can lead to reading arbitrary files from the...

CVE-2022-25298 Path Traversal

This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server...

CVE-2022-25298

This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server...

sprinfall webcc 路径遍历漏洞

Webcc is a lightweight C++ Http client and server library based on Asio by the individual developer Chunting Gu in China. A security vulnerability exists in sprinfall webcc, which can be exploited to obtain arbitrary files from the server by traversing directories...

CVE-2022-25179

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the...

PT-2022-17118 · Jenkins · Jenkins Pipeline: Multibranch Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Multibranch Plugin versions 706.vd43c65dec013 and earlier Jenkins Pipeline: Multibranch Plugin prior to 2.23.1, 2.26.1, 696.698.v9b4218eea50f, and 707.v71c3f0a 6ccdb Description: The issue allows attackers with permission to...

The vulnerability of the `path_getbbox` function in the Python Pillow image processing library, related to an incorrect path limitation for the directory, allows a hacker to gain access to arbitrary files on the system.

The vulnerability of the pathgetbbox function in the Python Pillow image processing library is related to an incorrect path limitation for the directory. Exploiting this vulnerability could allow a malicious actor to gain access to arbitrary files on the system by sending a specially crafted HTTP...

Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI

The plugin does not validate the data passed to its load shortcode, which could allow Contributor+ v 4.0.1 or Admin+ v 4.0.2 users to display arbitrary files from the filesystem such as logs, .htaccess etc, as well as perform Local File Inclusion attacks as PHP files will be executed. Please note...

Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI

The plugin does not validate the data passed to its load shortcode, which could allow Contributor+ v 4.0.1 or Admin+ v 4.0.2 users to display arbitrary files from the filesystem such as logs, .htaccess etc, as well as perform Local File Inclusion attacks as PHP files will be executed. Please note...

Mageia: Security Advisory (MGASA-2015-0079)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-46104

An issue was discovered in webpservergo 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server...

Webp_Server_Go 路径遍历漏洞

WebpServerGo is a Go version of WebP Server. It is used to instantly compress Jpg/Png into WebP format. A path traversal vulnerability exists in WebpServerGo version 0.4.0, which stems from a lack of filtering and escaping of directory special characters in the software, resulting in a directory...

Samsung Mobile DressRoom Arbitrary File Access Vulnerability

Samsung Mobile is a cell phone from the South Korean company Samsung. An arbitrary file access vulnerability exists in Samsung Mobile DressRoom, which stems from incorrect cleaning of the Incoming Intent in Dressroom, and can be exploited by a local attacker to read and write arbitrary files...

Path Traversal

Overview Affected versions of this package are vulnerable to Path Traversal. It is possible to traverse directories to fetch arbitrary files from the server. PoC curl --path-as-is "http://localhost:8888/static/../secret.json" Details A Directory Traversal attack also known as path traversal aims ...