mojoPortal 路径遍历漏洞

mojoPortal is an open source, object-oriented web architecture WSF and content management system CMS from Joe Audette, an individual developer in the United States. The system provides event calendars, photo albums, file managers, etc. mojoPortal v2.7 version of the path traversal vulnerability,...

Heartex Label Studio 代码问题漏洞

Label Studio is an open source data labeling tool from Heartex. Heartex Label Studio Community Edition 1.5.0 and previous versions contain a server-side request forgery vulnerability that stems from a failure to properly validate user input in the data import module, which could be exploited by a...

PT-2022-25227 · Unknown · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal version 2.7 Description: The issue allows authenticated attackers to read arbitrary files in the system due to a path traversal vulnerability. This vulnerability can be exploited via the f parameter at the...

CVE-2022-36551

A Server Side Request Forgery SSRF in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling...

Cybelsoft ThinVNC Directory Traversal (CVE-2019-17662)

A Directory Traversal vulnerability exists in Cybelsoft ThinVNC. Successful exploitation of this vulnerability could allow a remote attacker to disclose or access arbitrary files on the vulnerable server...

GHSA-52M2-VC4M-JJ33 Twig may load a template outside a configured directory when using the filesystem loader

Description When using the filesystem loader to load templates for which the name is a user input, it is possible to use the source or include statement to read arbitrary files from outside the templates directory when using a namespace like @somewhere/../some.file in such a case, validation is...

Hertz path traversal vulnerability

Hertz is a Golang microservices HTTP framework open sourced by CloudWeGo. v0.3.0 of Hertz contains a path traversal vulnerability that stems from a failure of the normalizePath function to properly filter special elements in a resource or file path. An attacker could exploit this vulnerability to...

DNN 路径遍历漏洞

DNN also known as DotNetNuke is a set of U.S. DNN by Microsoft support , based on the ASP.NET platform for open source content management system CMS. The system is easy to install , scalable , feature-rich features . DNN 9.11.0 before the version of the path traversal vulnerability exists. An...

Cisco IOS XE SD-WAN Software and SD-WAN Software Path Traversal Vulnerability

Cisco IOS XE SD-WAN Software and Cisco SD-WAN are both products of Cisco U.S.A. Cisco IOS XE SD-WAN Software is a software for network management software-defined networking applied to the Cisco IOS XE network operating system. The Cisco IOS XE SD-WAN and Cisco SD-WAN are vulnerable to a path...

Sensio Labs Twig Path Traversal Vulnerability

Sensio Labs Twig is a PHP templating engine from Sensio Labs, France, which supports custom tags and filters and creates DSLs. A path traversal vulnerability exists in Sensio Labs Twig 1.0.0 and later, versions prior to 1.44.7, 2.0.0 and later, versions prior to 2.15.3, and 3.0.0 and later,...

Deserialization Of Untrusted Data

scala-library is vulnerable to deserialization of untrusted data. The vulnerability exists because the readObject function in the LazyList.scala allows an attacker to erase the contents of arbitrary files, make network connections, or possibly run arbitrary code on Function0 via a gadget chain...

Design/Logic Flaw

IBM InfoSphere Information Server 8.1, 8.5, and 8,7 could allow a remote authenticated attacker to obtain sensitive information, caused by improper restrictions on directories. An attacker could exploit this vulnerability via the DataStage application to load or import content functionality to vi...

CVE-2022-28814

Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device...

Path traversal

Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device...

Information Disclosure

soap is vulnerable to information disclosure. The vulnerability exists due to the lack of restrictions in the XML external entity reference of the library, allowing an attacker to read arbitrary files over HTTP...

Smart eVision 路径遍历漏洞

Smart eVision Information Technology Smart eVision is a business intelligence platform of China Union Quan Information Technology Smart eVision Information Technology Company. It can integrate business management room, dashboards, reports, and input interfaces for business operation management...

Zimbra Collaboration Suite Remote Code Execution Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaborative office suite. The product includes WebMail, Calendar, Address Book, etc. A security vulnerability exists in Zimbra Collaboration Suite ZCS versions 8.8.15 and 9.0, which stems from a lack of valid authentication of uploaded files by t...

Sensio Labs Twig 路径遍历漏洞

Sensio Labs Twig is a PHP templating engine from Sensio Labs, France, which supports custom tags and filters and creates DSLs. A path traversal vulnerability exists in Sensio Labs Twig 1.0.0 and later, versions prior to 1.44.7, 2.0.0 and later, versions prior to 2.15.3, and 3.0.0 and later,...

PT-2022-19254 · Carlo Gavazzi · Carlo Gavazzi Uwp3.0

Name of the Vulnerable Software and Affected Versions: Carlo Gavazzi UWP3.0 versions affected versions not specified CPY Car Park Server version 2.8.3 Description: The issue allows remote attackers to read arbitrary files and gain full control of the device through a relative path traversal...

CVE-2022-3076

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example...