SUSE CVE-2016-10173

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. dot dot in a TAR archive entry...

SUSE CVE-2018-14355

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name...

SUSE CVE-2022-4244

A flaw was found in codeplex-codehaus. A directory traversal attack also known as path traversal aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash ../" sequences and their variations or by using absolute file paths, it may be possib...

SUSE CVE-2022-30580

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset...

CVE-2022-43864

IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 239427...

Path Traversal

lite-dev-server is vulnerable to path traversal. The vulnerability exists in server.js because it aims to access files and directories that are stored outside the intended folder. By manipulating files with dot-dot-slash ../ sequences and its variations it may be possible to access arbitrary file...

PT-2022-7281 · Apache +1 · Apache Ivy +1

Name of the Vulnerable Software and Affected Versions: Apache Ivy versions 2.0.0 through 2.5.1 Description: The issue is related to the incorrect restriction of the directory path name in the Apache Ivy package manager. This can allow a remote attacker to gain unauthorized access to the file...

Archive_Tar: directory traversal due to inadequate checking of symbolic links

A flaw was found in the ArchiveTar package. ArchiveTar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences /../ to modify...

Archive_Tar: directory traversal due to inadequate checking of symbolic links

A flaw was found in the ArchiveTar package. ArchiveTar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences /../ to modify...

CVE-2022-38794

Zaver through 2020-12-15 allows directory traversal via the GET /.. substring...

CVE-2021-3688

A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolons. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest...

PT-2022-10589 · Red Hat · Red Hat Jboss Core Services Http Server

Name of the Vulnerable Software and Affected Versions: Red Hat JBoss Core Services HTTP Server affected versions not specified Description: A flaw was found in Red Hat JBoss Core Services HTTP Server where it does not properly normalize the path component of a request URL containing...

Red Hat JBoss Core Services 信息泄露漏洞

Red Hat JBoss Core Services is software that complements the suite of Red Hat JBoss middleware products from Red Hat, Inc. An information disclosure vulnerability exists in all versions of Red Hat JBoss Core Services HTTP Server that stems from its failure to properly specify the path component o...

AZL-79108 CVE-2022-30580 affecting package golang 1.25.7-1

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset...

Symfony Directory Traversal

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

Directory Traversal

Overview mixlib-archive is a simple interface to various archive formats Affected versions of this package are vulnerable to Directory Traversal allowing attackers to overwrite arbitrary files by supplying a filename for a tar archive involving ... Details A Directory Traversal attack also known ...

Path Traversal due to `send_file` call

A path traversal attack also known as directory traversal aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash ../” sequences and its variations or by using absolute file paths, it may be possible to...

VulnCheck KEV: CVE-2015-7254

Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. dot dot in an icon/ URI...

Aim 路径遍历漏洞

Aim is an easy-to-use and high-performance open source experiment tracker from the U.S. A path traversal vulnerability exists in versions of Aim prior to 3.1.0, which can be exploited by an attacker to access arbitrary files and directories stored on the file system by manipulating references to...

JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure

A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolons. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest...