2825 matches found
Imporoper path validation in elFinder.NetCore
This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation...
OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
The plugin does not enforce path validation, authorisation and CSRF checks in the omgfajaxemptydir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server. PoC As an authenticated user, with a role as low as subscriber, viewing the admin the dashboard...
CVE-2021-39240
An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field as observed on a target HTTP/2 server might differ from what the routing rule...
CVE-2021-38573: Undefined Security Weakness
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated...
CVE-2020-23172
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives...
CVE-2020-23172: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives...
The vulnerability of the OpenSSL library used in OpenVPN software allows a hacker to execute arbitrary code.
The vulnerability of the OpenSSL library used in OpenVPN software is related to errors in the path validation mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
多款华为产品路径遍历漏洞
Huawei Mate 20 and others are products of China's Huawei Huawei.Huawei Mate 20 is a smartphone.Huawei Honor Magic 2 is a smartphone.Huawei Mate 20 Pro is a smartphone.Huawei Mate 20 Pro is a smartphone.Huawei Mate 20 Pro is a smartphone.Huawei Mate 20 Pro is a smartphone.Huawei Mate 20 Pro is a...
SUSE: Security Advisory (SUSE-SU-2020:3359-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
The vulnerability of the KOMPAS 3D automated design system lies in its uncontrolled mechanism for checking the path of dynamically attached libraries. This allows a perpetrator to execute arbitrary code.
The vulnerability of the KOMPAS-3D three-dimensional modeling system is related to an uncontrolled mechanism for checking the path of dynamically attached libraries. Exploiting this vulnerability could allow a attacker to execute arbitrary code by replacing the DLL library...
CVE-2021-1525
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attacker could exploit this vulnerability b...
CVE-2021-1525
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attacker could exploit this vulnerability b...
Apple macOS Big Sur 输入验证错误漏洞
Apple macOS Big Sur is a mobile application app from Apple Inc. A security vulnerability exists in macOS Big Sur, which arises from incorrect file path validation within the App Store component, allowing malicious applications to bypass implemented security restrictions. Versions affected: macOS:...
CVE-2021-31913
In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirecturi were made during GitHub SSO token exchange...
CVE-2021-1532
A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability is due to insufficient path validation o...
CVE-2021-1532: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability is due to insufficient path validation o...
CVE-2021-1532
A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to read arbitrary files from the underlying operating system. This vulnerability is due to insufficient path validation o...
Parallels Desktop Toolgate Directory Traversal Arbitrary File Deletion Vulnerability
Parallels Desktop is a virtual machine software that runs on Mac computers. A security vulnerability exists in the Toolgate component in Parallels Desktop version 16.1.1-49141. The vulnerability stems from failure to properly validate a user-supplied path before using it in a file operation. An...
CVE-2021-31421
This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists...
CVE-2021-31421
This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists...