Ubuntu 16.04 LTS / 24.04 LTS / 24.10 : Apache Shiro vulnerabilities (USN-7147-1)

The remote Ubuntu 16.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7147-1 advisory. It was discovered that Apache Shiro incorrectly handled path traversal when used with other web frameworks or path rewriting. An...

CVE-2024-0129

NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering...

CVE-2024-43797 Path Traversal in audiobookshelf

audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries or access only the ones they have permission to. However, the LibraryController is missing the check for admin user and thus allows a path traversal issue. Allowing non-admin users to...

RHEL 6 : pam (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - pam: path traversal issue in pamtimestamp's formattimestampname CVE-2014-2583 - The pamuserdb module for...

PT-2024-23882 · WordPress · Wp Poll Maker

Name of the Vulnerable Software and Affected Versions: WP Poll Maker versions prior to 3.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This allows for potential unauthorized access to files...

PT-2023-24313 · Suprema · Suprema Biostar 2

Name of the Vulnerable Software and Affected Versions: Suprema BioStar 2 versions prior to 2.9.1 Description: A path traversal issue exists, allowing unauthenticated attackers to fetch arbitrary files from the server's web server. Recommendations: For Suprema BioStar 2 versions prior to 2.9.1,...

Fedora 38 : wordpress (2023-e18d3d4004)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-e18d3d4004 advisory. WordPress 6.2.2 Security Release Security updates included in this release: Block themes parsing shortcodes in user-generated data; thanks to Liam Gladdy of ...

CVE-2023-31477

A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path...

PT-2023-23356 · Gl.Inet · Gl.Inet

Name of the Vulnerable Software and Affected Versions: GL.iNet devices versions prior to 3.216 Description: A path traversal issue was discovered, allowing the sharing of arbitrary directories, such as /tmp or /etc, through the file sharing feature due to the lack of server-side restrictions...

PT-2023-1916 · Rockwell Automation · Thinmanager Thinserver

Name of the Vulnerable Software and Affected Versions: Rockwell Automation's ThinManager ThinServer affected versions not specified Description: A path traversal issue exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could...

PT-2023-19788 · Owncloud · Owncloud Android App

Name of the Vulnerable Software and Affected Versions: ownCloud Android app versions prior to 3.0 Description: The ownCloud Android app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. These bypasses may lead to information disclosure when uploading the...

PT-2023-18215 · Samsung · Samsung Cloud

Name of the Vulnerable Software and Affected Versions: Samsung Cloud versions prior to 5.3.0.32 Description: A path traversal issue exists, allowing an attacker to access a specific png file. Recommendations: For versions prior to 5.3.0.32, update to version 5.3.0.32 or later to resolve the issue...

PT-2022-24703 · Unknown · Rava Certificate Validation System

Name of the Vulnerable Software and Affected Versions: RAVA certification validation system affected versions not specified Description: The RAVA certification validation system has a path traversal issue. This allows an unauthenticated remote attacker to bypass authentication and access arbitrar...

PT-2022-25388 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: An absolute path traversal issue allows attackers to obtain sensitive information via a crafted GET request sent to "/one/siteinfo.php". Recommendations: For ZZCMS version 2022, as a temporary workaround,...

PT-2022-24658 · Huawei · Emui +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The number identification module has a path traversal issue. This could lead to data disclosure if successfully exploited. Recommendations: At the moment, there is no information...

Insecure path traversal in Git Trigger Source can lead to arbitrary file read

Impact A path traversal issue was found in the g GitArtifactReader.Read API. Read calls into g GitArtifactReader.readFromRepository that opens and reads the file that contains the trigger resource definition: go func g GitArtifactReader readFromRepositoryr git.Repository, dir string No checks are...

Mageia: Security Advisory (MGASA-2016-0016)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:0028-1 Security update for python-Babel

This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal leading to loading arbitrary locale files on disk and executing arbitrary code bsc1185768...

PT-2021-23244 · Unknown · Ecoa Bas Controller

Name of the Vulnerable Software and Affected Versions: ECOA BAS controller affected versions not specified Description: The ECOA BAS controller is affected by an arbitrary file write and path traversal issue. Unauthenticated attackers can exploit this by using POST parameters to set arbitrary...

PT-2021-17923 · Qnap · Qnap Nas +2

Name of the Vulnerable Software and Affected Versions: QNAP NAS versions prior to QTS 4.5.2.1630 Build 20210406 QNAP NAS versions prior to QTS 4.3.6.1663 Build 20210504 QNAP NAS versions prior to QTS 4.3.3.1624 Build 20210416 QuTS hero versions prior to h4.5.2.1638 Build 20210414 Description: A...