CVE-2024-34033

Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten...

CVE-2024-34033

Delta Electronics DIAEnergie is affected by a Path Traversal (CWE-22) due to insufficient input validation, allowing an attacker to write files outside the intended directory. Public references indicate affected DIAEnergie versions include v1.10.00.005, with remediation available in v1.10.01.004....

CVE-2024-34033 Path Traversal vulnerability in Delta Electronics DIAEnergie

Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten...

CVE-2024-31965

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct a path traversal attack due to insufficient input...

CVE-2024-31965

The CVE-2024-31965 affects Mitel 6800 Series, 6900 Series SIP phones (through 6.3 SP3 HF4), 6900w Series SIP Phone (through 6.3.3), and 6970 Conference Unit (through 5.1.1 SP8). The root cause is insufficient input validation that enables an authenticated attacker with administrative privileges t...

PT-2024-23297 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: The issue is related to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this by...

CVE-2024-25567

Delta Electronics DIAEnergie is affected by CVE-2024-25567 (Path traversal) in versions prior to v1.10.00.005. The flaw allows writing outside the intended directory and potential access to sensitive files, with overwrite of existing files possible. Root cause: path traversal (CWE-22). Impact per...

CVE-2024-28171 Delta Electronics DIAEnergie Path traversal

It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten...

CVE-2024-28171

CVE-2024-28171 describes a path traversal vulnerability in Delta Electronics DIAEnergie. The issue allows an attacker to write outside the intended directory; if a file name already exists, the original file can be overwritten. Public-facing details in connected sources (e.g., EUVD-2024-25301, CN...

CVE-2024-29180

CVE-2024-29180 affects the webpack-dev-middleware development middleware used with webpack-dev-server/webpack-dev-middleware. The vulnerability arises from improper URL unescaping/normalization before parsing the requested file, allowing path traversal via sequences like %2e and %2f to access loc...

BIT-APACHE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default...

CentOS 9 : pesign-115-6.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the pesign-115-6.el9 build changelog. - A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACL...

SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2024:0643-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0643-1 advisory. Update to 20.11.1: security updates CVE-2024-21892: Code injection and privilege escalation through Linux capabilitie...

CVE-2024-25840

In the module "Account Manager | Sales Representative & Dealers | CRM" prestasalesmanager up to 9.0 from Presta World for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack...

CVE-2024-25840

In the module "Account Manager | Sales Representative & Dealers | CRM" prestasalesmanager up to 9.0 from Presta World for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack...

PT-2024-21152 · Unknown · Prestasalesmanager +1

Name of the Vulnerable Software and Affected Versions: PrestaShop module "Account Manager | Sales Representative & Dealers | CRM" prestasalesmanager versions up to 9.0 Description: A guest can download personal information without restriction by performing a path traversal attack in the affected...

CVE-2024-21891

A flaw was found in Node.js. Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwritten with user-defined implementations, leading to a filesystem permission model bypass through a path traversal attack...

CVE-2024-21891

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experiment...

CVE-2024-21891

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experiment...

CVE-2024-21891

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experiment...