Design/Logic Flaw

ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page most likely limited to administrator, to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By...

CVE-2018-12980

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server...

[ASA-201807-2] git-annex: multiple issues

Arch Linux Security Advisory ASA-201807-2 ========================================= Severity: High Date : 2018-07-04 CVE-ID : CVE-2018-10857 CVE-2018-10859 Package : git-annex Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-725 Summary ======= The package git-annex...

iter-http directory traversal vulnerability

iter-http is a Node.js based http server. A directory traversal vulnerability exists in iter-http. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence into the URL to gain access to the file system...

node-simple-router directory traversal vulnerability

node-simple-router is a simple router for Node. A directory traversal vulnerability exists in node-simple-router. An attacker can exploit this vulnerability by placing a '... /' sequence in a URL to gain access to the file system...

fsk-server Directory Traversal Vulnerability

Node.js module fsk-server is a simple http server. A directory traversal vulnerability exists in fsk-server. An attacker can exploit this vulnerability by placing ". /" in a url to access the file system...

List-n-stream Directory Traversal Vulnerability

list-n-stream is a video list module. A directory traversal vulnerability exists in list-n-stream version 0.0.10 and earlier. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

CVE-2018-3760

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...

CVE-2018-3760

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...

CVE-2018-3760

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...

Information disclosure

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...

CVE-2018-3760

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...

wffserve Path Traversal Vulnerability

wffserve is a file server. A directory traversal vulnerability exists in wffserve. An attacker can exploit this vulnerability by placing a '... /' sequence in a URL to gain access to the file system...

scott-blanch-weather-app path traversal vulnerability

scott-blanch-weather-app is a Node.js weather app built with Express. A path traversal vulnerability exists in scott-blanch-weather-app. An attacker can exploit this vulnerability by placing a '... /' sequence in the URL to gain access to the file system...

GHSA-PR3H-JJHJ-573X Sprockets path traversal leads to information leak

Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. Workaround:...

datachannel-client path traversal vulnerability

datachannel-client is a signaling implementation based on Node.js and Socket.io. A path traversal vulnerability exists in datachannel-client. An attacker can exploit this vulnerability by placing a '... /' sequence in a URL to gain access to the file system...

Infraserver Directory Traversal Vulnerability

infraserver is a RESTful server. A directory traversal vulnerability exists in infraserver. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

commentapp.stetsonwood directory traversal vulnerability

commentapp.stetsonwood is a HTTP server. A directory traversal vulnerability exists in commentapp.stetsonwood. An attacker can exploit this vulnerability to gain access to the file system by placing the '... /' sequence in a URL to gain access to the file system...

node-server-forfront path traversal vulnerability

node-server-forfront is a static file server. A path traversal vulnerability exists in node-server-forfront. An attacker can gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

jikes path traversal vulnerability

jikes is a file server. A directory traversal vulnerability exists in jikes. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence into a URL to gain access to the file system...