Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2021-34997

CVE-2021-34997 affects Commvault CommCell 11.22.22 (vulnerable versions include 11.22.x; fixed in 11.25+ per CNVD). Root cause: AppStudioUploadHandler validates user-supplied data inadequately, allowing arbitrary file uploads. This leads to remote code execution in the NETWORK SERVICE context. Ex...

CVE-2021-34995

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2021-23514

This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server...

CVE-2021-23514

CVE-2021-23514 affects Crow before 0.3+4. A path traversal flaw allows an attacker to traverse directories and fetch arbitrary files from the server via supported endpoints. The vulnerability is described across multiple sources (e.g., NVD/CVE entry; CNVD/CNNVD; Snyk references) as a directory tr...

CVE-2018-15687

A race condition in chownone of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239...

CVE-2021-35500

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local acces...

CVE-2021-35500

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local acces...

CVE-2021-35500

CVE-2021-35500 affects TIBCO Data Virtualization: Data Virtualization Server. The vulnerability enables a low-privilege, local attacker to download arbitrary files outside the user’s permissions due to insufficient access controls on the file download feature. Affected releases: TIBCO Data Virtua...

CVE-2021-28377

ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files...

CVE-2021-28377

ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files...

CVE-2021-28376

ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files...

CVE-2021-28376

ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files...

Directory traversal

ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files...

CVE-2021-28376

ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files...

CVE-2021-28377

ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files...

CVE-2022-0013 Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support File

A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex XDR agent 5.0 versions earlier than...

Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support File

A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex XDR agent 5.0 versions earlier than...

Path Traversal

Overview Affected versions of this package are vulnerable to Path Traversal. It is possible to traverse directories to fetch arbitrary files from the server. PoC curl --path-as-is "http://localhost:8888/static/../secret.json" Details A Directory Traversal attack also known as path traversal aims ...

VulnCheck KEV: CVE-2010-4598

Directory traversal vulnerability in Ecava IntegraXor 3.6.4000.0 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter in an open request...