CVE-2023-28023: Cross-Site Request Forgery (CSRF)

A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO attacker to access files on server side systems server machine and all the ones in its network...

CVE-2023-33871: Undefined Security Weakness

Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an unauthenticated user to directly access any file outside the webroot...

PT-2023-22163 · Rockwell Automation · Rockwell Automation Thinmanager Thinserver

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ThinManager ThinServer affected versions not specified Description: A path traversal issue exists in the HTTPS Server Settings API feature of Rockwell Automation ThinManager ThinServer. This feature is disabled by default...

Financial Services Agency XBRL 代码问题漏洞

Financial Services Agency XBRL is a Financial Services Agency XBRL data creation application from the Financial Services Agency, Inc. of Japan. A security vulnerability exists in Financial Services Agency XBRL 7.0 and prior versions that stems from improperly restricting XML External Entity...

The vulnerability of the Podman software for managing and starting OCI containers on operating systems such as Red Hat Enterprise Linux, RedOS, and the corporate platform Red Hat OpenShift Container Platform allows a attacker to gain access to arbitrary files in the host’s file system.

The vulnerability of the Podman software for managing and starting OCI containers on Red Hat Enterprise Linux, RedOS, and the corporate platform Red Hat OpenShift Container Platform is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow a malicio...

VulnCheck KEV: CVE-2023-26256

An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By modifying the fileName parameter to the snjFooterNavigationConfig endpoint, it is possible to traverse and read the file system...

PT-2023-4939 · Advantech · Webaccess/Scada

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess/SCADA versions prior to 9.1.4 Description: The issue is related to the use of untrusted pointers in the software. Specifically, the RPC arguments sent by the client could contain raw memory pointers that the server uses...

Apache Airflow Path Traversal Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A path traversal vulnerability exists in Apache Airflow versions prior to 2.6.3,...

CVE-2023-37474: Improper Limitation of a Pathname to a Restricted Directory

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the .cpr subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This...

PT-2023-25843 · Unknown · Archer Platform

Name of the Vulnerable Software and Affected Versions: Archer Platform versions prior to 6.13 Description: The issue allows an authenticated attacker to obtain sensitive information via the log files. Recommendations: For versions prior to 6.12.0.6, update to version 6.12.0.6 or later. For versio...

VulnCheck KEV: CVE-2023-37474

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the .cpr subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This...

SonicWall GMS and Analytics 路径遍历漏洞

SonicWALL Analytics and SonicWALL GMS are both products of SonicWALL, Inc. of the U.S. SonicWALL Analytics is a high-performance management and reporting engine for the Web.SonicWALL GMS is a global management system. A powerful and intuitive solution for organizations, distributed enterprises, a...

Directory traversal

The Syncfusion EJ2 ASPCore File Provider 3ac357f is vulnerable to Models/PhysicalFileProvider.cs directory traversal. As a result, an unauthenticated attacker can list files within a directory, download any file, or upload any file to any directory accessible by the web server...

CVE-2023-38046

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system...

Apache Airflow Path Traversal vulnerability

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the runid parameter. This vulnerability is considered low since it requires an authenticated user to exploit i...

CVE-2023-22887

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the runid parameter. This vulnerability is considered low since it requires an authenticated user to exploit i...

PYSEC-2023-104

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the runid parameter. This vulnerability is considered low since it requires an authenticated user to exploit i...

PYSEC-2023-104

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the runid parameter. This vulnerability is considered low since it requires an authenticated user to exploit i...

CVE-2023-22887

CVE-2023-22887 affects Apache Airflow versions before 2.6.3. The issue enables an authenticated attacker to perform unauthorized file access outside the intended directory by manipulating the run_id parameter (path traversal). The vulnerability is described as low impact since exploitation requir...

CVE-2023-22887 Apache Airflow path traversal by authenticated user

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the runid parameter. This vulnerability is considered low since it requires an authenticated user to exploit i...