Linux Distros Unpatched Vulnerability : CVE-2020-1757

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final,...

Linux Distros Unpatched Vulnerability : CVE-2023-2454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - schemaelement defeats protective searchpath changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated...

K000152931: Multiple PostgreSQL vulnerabilities

Security Advisory Description CVE-2023-2455 Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other...

tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources

A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths...

The vulnerability of the cross-platform integrated development environment JetBrains Rider, related to bypassing the relative path, allows a malicious user to gain read, modify, or delete access to data.

The vulnerability of the cross-platform integrated software development environment JetBrains Rider is related to the exploitation of a relative path. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain read, modify, or delete access to data...

PYSEC-2025-118

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This...

Directory Traversal

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\. An attacker could read...

WS-2022-0120

This vulnerability effects the built-in afire servestatic extension allowing paths containing //.... to bypass the previous path sanitation and request files in higher directories that should not be accessible. The issue has been fixed in afire 1.1.0...

Consul L7 Intentions Vulnerable To URL Path Bypass

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules. This vulnerability, identified as CVE-2024-10005, is fixed in Consul Community Edition 1.20.1 and Consul Enterprise...

CVE-2024-10005: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules...

The vulnerability in the web interface of the Cisco Emergency Responder, a server for managing and monitoring emergency calls, allows an attacker to gain read, modify, or delete access to data.

The vulnerability in the web interface of the Cisco Emergency Responder server for emergency response management and monitoring involves bypassing a relative path. Exploiting this vulnerability allows an attacker operating remotely to gain read, modify, or delete access to data...

Huawei HarmonyOS/EMUI File Path Bypass Vulnerability

Huawei HarmonyOS is a distributed operating system developed independently by Huawei Technologies Co. Huawei EMUI is Huawei's emotional operating system based on Android. A file path bypass vulnerability exists in Huawei HarmonyOS/EMUI, which stems from a file path bypass vulnerability in email. ...

The vulnerability in the Roxy-WI web interface for managing Haproxy, Nginx, Apache, and Keepalived allows a attacker to access protected information.

The vulnerability of the getconfig function in the /app/modules/config/config.py file of the Roxy-WI web interface for controlling Haproxy, Nginx, Apache, and Keepalived servers is related to the possibility of bypassing the path. Exploiting this vulnerability can allow a malicious actor to gain...

CVE-2024-27318

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch adde...

ConnectWise ScreenConnect Security Breach

ConnectWise ScreenConnect is a self-hosted remote desktop software application from ConnectWise. A security vulnerability exists in ConnectWise ScreenConnect version 23.9.7 and prior versions, which stems from being affected by the use of an alternate path or channel to bypass authentication, and...

Path Traversal

io.github.pixee: java-security-toolkit is vulnerable to a partial path traversal bypass. The vulnerable is due to currentDirectory.getCanonicalPath returning a path that is not terminated by a trailing slash. As such, using startsWith to do string comparisons opens up a flaw allowing for...

The vulnerability of the administration console of a cross-platform real-time collaboration server like Openfire, related to the possibility of bypassing the path, allows attackers to increase their privileges.

The vulnerability of the administration console of a cross-platform real-time collaboration server like Openfire is related to the possibility of bypassing the authentication process. Exploiting this vulnerability allows an attacker who operates remotely to enhance their privileges...

PT-2023-27228 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 3.8.15 Craft versions prior to 4.4.15 Description: The issue is related to bypassing the validatePath function, which can lead to potential remote code execution. This can result in malicious control of vulnerable...

CVE-2023-32004

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using th...

CVE-2023-32004

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using th...