489 matches found
Path Injection
github.com/fkie-cad/yapscan is vulnerable to path injection. The vulnerability exists due to lack of permission validations in the report receiver server which allows an attacker to perform log injections...
SUSE: Security Advisory (SUSE-SU-2022:4593-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE-SU-2022:4593-1 Security update for cni-plugins
This update for cni-plugins fixes the following issues: - CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration bsc1181961...
SUSE-SU-2022:4592-1 Security update for cni
This update for cni fixes the following issues: - CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration bsc1181961...
CVE-2022-23512
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value testId in new...
Path traversal
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value testId in new...
CVE-2022-23512 Metersphere is vulnerable to Path Injection.
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value testId in new...
CVE-2022-23512 Metersphere is vulnerable to Path Injection.
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value testId in new...
CVE-2022-23512
MeterSphere (open source continuous testing platform) has a path injection vulnerability in ApiTestCaseService::deleteBodyFiles. The issue arises when a user-supplied string id is concatenated into the file path (BODY_FILE_DIR + "/" + testId) and later deleted via file.delete(), enabling manipula...
CVE-2022-23512 Metersphere is vulnerable to Path Injection.
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value testId in new...
CVE-2022-23512
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value testId in new...
PT-2022-16043
Name of the Vulnerable Software and Affected Versions MeterSphere versions prior to 2.4.1 Description The issue concerns a Path Injection vulnerability in the ApiTestCaseService::deleteBodyFiles function, which takes a user-controlled string id and uses the provided value testId to construct a fi...
CVE-2022-23512: Improper Limitation of a Pathname to a Restricted Directory
MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFiles which takes a user-controlled string id and passes it to ApiTestCaseService, which uses the user-provided value testId in new...
PT-2022-27879 · Unknown · Concrete Cms
Name of the Vulnerable Software and Affected Versions: ConcreteCMS version 9.1.3 Description: The issue allows attackers to access sensitive XML data via a crafted payload injected into the URL path folder "3". This is due to an Xpath injection vulnerability. Recommendations: For ConcreteCMS...
SUSE: Security Advisory (SUSE-SU-2022:4150-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE-SU-2022:4151-1 Security update for cni-plugins
This update for cni-plugins fixes the following issues: - CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration bsc1181961...
SUSE-SU-2022:4150-1 Security update for cni
This update for cni fixes the following issues: - CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration bsc1181961...
CVE-2022-20850
A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit...
A flaw was found in Python specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1 3.9.5 3.8.11 3.7.11 and 3.6.14.
...
