36 matches found
HashiCorp Nomad和HashiCorp Nomad Enterprise 安全漏洞
HashiCorp Nomad and HashiCorp Nomad Enterprise are both products of HashiCorp, Inc. of the U.S. HashiCorp Nomad is a simple and flexible scheduler and orchestrator. HashiCorp Nomad is a simple and flexible scheduler and orchestrator for managing containerized and non-containerized applications at...
PT-2024-37819
Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.6.12 through 1.7.9 HashiCorp Nomad and Nomad Enterprise version 1.8.1 Description The issue concerns archive unpacking during migration, where path escaping of the allocation directory is possibl...
USN-6019-1 python-flask-cors vulnerability
It was discovered that Flask-CORS did not properly escape paths before evaluating resource rules. An attacker could possibly use this to expose sensitive information...
SUSE CVE-2017-16667
backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...
CVE-2023-24815 Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web
Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard then an attacker can exfiltrate a...
UBUNTU-CVE-2023-22456
ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository...
Design/Logic Flaw
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is...
Tauri 安全漏洞
Tauri is Tauri open source to build smaller, faster and more secure desktop applications using a Web front end. Tauri versions prior to 1.0.7 and 1.1.2 have a security vulnerability , the vulnerability stems from its file dialog box and drag-and-drop functionality to select the path of special...
PT-2021-14419
Name of the Vulnerable Software and Affected Versions fastify-http-proxy versions prior to 4.3.1 Description The issue allows an attacker to escape the prefix of the proxied backend service by crafting a specific URL. For example, if the base URL of the proxied server is /pub/, an attacker can...
GHSA-66Q9-F7FF-MMX6 Local file inclusion vulnerability in http4s
Impact This vulnerability applies to all users of: org.http4s.server.staticcontent.FileService org.http4s.server.staticcontent.ResourceService org.http4s.server.staticcontent.WebjarService Path escaping URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expos...
Local file inclusion vulnerability in http4s
Impact This vulnerability applies to all users of: org.http4s.server.staticcontent.FileService org.http4s.server.staticcontent.ResourceService org.http4s.server.staticcontent.WebjarService Path escaping URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expos...
CVE-2019-10771
Characters in the GET url path are not properly escaped and can be reflected in the server response...
CVE-2019-10771
Characters in the GET url path are not properly escaped and can be reflected in the server response...
UBUNTU-CVE-2017-16667
backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...
DEBIAN-CVE-2017-16667
backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...
