Linux Distros Unpatched Vulnerability : CVE-2021-20206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field i...

IBM Power Hardware Management Console 路径遍历漏洞

The IBM Power Hardware Management Console HMC is a suite of graphical interface software from International Business Machines IBM for configuring and managing the Power System family of servers. The software is primarily used to manage hardware such as servers. A path traversal vulnerability exis...

Path Traversal

github.com/clidey/whodb/core is vulnerable to Path Traversal. The vulnerability is due to improper path validation due to the lack of checks when joining user-controlled database file names with the default directory, allowing an attacker to use path traversal ../../ to access any Sqlite3 databas...

The vulnerability of the CMSimple content management system, related to incorrect restrictions on the path to the restricted access catalog, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the CMSimple content management system is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending a specially crafted GET request...

Privilege Escalation

net.snowflake:snowflake-jdbc is vulnerable to Privilege Escalation. The vulnerability is due to improper path handling due to an attacker with write access to a directory in %PATH% being able to escalate privileges when the EXTERNALBROWSER authentication method is used on Windows...

PT-2024-17750 · Arista · Arista Ng Firewall

Name of the Vulnerable Software and Affected Versions: Arista NG Firewall affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this issue. The specific...

WordPress plugin EduAdmin Booking 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

The vulnerability of the Manager component in the Wowza Streaming Engine server software allows a hacker to gain access and delete directories.

The vulnerability of the Manager component in the Wowza Streaming Engine server software is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain access and delete directories, provided that the target...

The vulnerability in the virtual learning environment Moodle, related to improper restrictions on the path name to a limited catalog, allows a intruder to gain access to confidential data.

The vulnerability in the virtual training environment Moodle is related to the local loading of files during the restoration of incorrect backup copies of modules. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential data...

Fortinet FortiManager和Fortinet FortiAnalyzer 路径遍历漏洞

Fortinet FortiManager and Fortinet FortiAnalyzer are both products of Fortinet, a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains ADOM to further simplify the...

The vulnerability of the software’s user data loading function for running large language models (LLMs) like ChuanhuChatGPT allows a perpetrator to execute arbitrary code.

The vulnerability of the software’s user data loading function for running large language models like ChuanhuChatGPT is related to an incorrect restriction on the path name to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the Vendure corporate platform lies in improper cleaning of file paths and bypassing directories due to insufficient verification of input data. This allows attackers to disclose protected information or cause service failures.

The vulnerability of the Vendure corporate platform lies in improper cleaning of file paths and bypassing directories due to insufficient verification of input data. Exploitation of this vulnerability can allow a malicious actor to disclose protected information or cause service failures...

openSUSE 15 Security Update : cargo-c (SUSE-SU-2024:3748-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:3748-1 advisory. Security fixes: - CVE-2024-45405: Fixed gix-path improper path resolution bsc1230683 Other fixes: - Update to version 0.10.3git0.ee7d7ef: Tenable has extract...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from improper ppath handling in the ext4extreplayupdateex function in the ext4 filesystem, which could lead to a...

The vulnerability of the Bluetooth module of the EMUI operating system of HarmonyOS allows a perpetrator to compromise the confidentiality of protected information.

The vulnerability of the Bluetooth module of the EMUI operating system of HarmonyOS is related to improper restrictions on the path name to the directory. Exploiting this vulnerability can allow attackers to compromise the confidentiality of the protected information...

Kingsoft WPS Office 12.2.0.13110 < 12.2.0.17119 Arbitrary Code Execution (CVE-2024-7263)

The version of Kingsoft WPS Office installed on the remote Windows host is at least 12.2.0.13110 and prior to 12.2.0.17119. It is, therefore, affected by an arbitrary code execution vulnerability: - Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from...

ZZCMS 路径遍历漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. ZZCMS suffers from an arbitrary file read vulnerability, which is due to a lack of effective validation of file paths and can be exploited by an attacker to perform directory traversal...

The vulnerability of the Dell Inventory Collector software’s equipment inventory system lies in the incorrect limitation of the path to the restricted-access catalog. This allows a perpetrator to execute arbitrary code.

The vulnerability of Dell Inventory Collector’s software for inventory management is related to incorrect restrictions on the path to the restricted-access catalog. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-7263

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 exclusive on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough...

CVE-2024-7262

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 exclusive on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive...