Design/Logic Flaw

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the context of the user running IGSS, due to missing validation of user supplied data in network messages. Affected Product: Interactive Graphica...

CVE-2022-24312

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a...

Design/Logic Flaw

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a...

CVE-2022-24312

Schneider Electric IGSS Data Server (IGSSdataServer.exe) v15.0.0.22020 and earlier is affected by CVE-2022-24312, a CWE-22 path traversal vulnerability that could allow modification of existing files or creation of new files in the Data Server context, potentially enabling remote code execution w...

CVE-2022-24311

Schneider Electric IGSS Data Server (v15.0.0.22020 and earlier) includes a CWE-22 path traversal vulnerability that can modify an existing file or create a new one in the Data Server context, potentially enabling remote code execution when a specially crafted message is sent. The Red Hat/ICSA adv...

CVE-2022-24311

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at beginning of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends...

CVE-2022-24312

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a...

RHEL 8 : gegl04 (RHSA-2022:0177)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0177 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gegl: shell expansion via a crafted pathname CVE-2021-4546...

gegl: shell expansion via a crafted pathname

Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able to lead to the execution of arbitrary shell commands that impacts availability, confidentiality and integrity...

gegl: shell expansion via a crafted pathname

Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able to lead to the execution of arbitrary shell commands that impacts availability, confidentiality and integrity...

Important: gegl04 security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gegl: shell expansion via a crafted pathname CVE-2021-45463 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE...

gegl: shell expansion via a crafted pathname

Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able to lead to the execution of arbitrary shell commands that impacts availability, confidentiality and integrity...

Important: Red Hat Security Advisory: gegl security update

An update for gegl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

The vulnerability of the fetch module in the Ansible configuration management system stems from deficiencies in path name restrictions, allowing attackers to access confidential data and compromise its integrity.

The vulnerability of the fetch module in the Ansible configuration system is related to deficiencies in pathname restrictions for directories. Exploiting this vulnerability could allow an attacker to access confidential data and compromise its integrity...

The vulnerability of the Node.js module for processing tar archives using Node-tar lies in the shortcomings of the pathname limitation, which allows attackers to compromise the integrity of the data and cause service failures.

The vulnerability of the Node.js module for processing tar archives using Node-tar is related to improper filtering of the '/' character sequence. Exploiting this vulnerability can allow an attacker to compromise data integrity and cause service failures...

Cross-site Scripting (XSS)

@keystone-6/auth is vulnerable to cross-site scripting. The vulnerability exists in the pageMiddleware function in index.ts as it does not properly set pathname, allowing an attacker to gain sensitive information by redirecting to malicious websites...

in ionicabizau/parse-url

Description urldomain validation bypass Proof of Concept parse-url not able verify urldomain properly when basic authentication is given .This allow to bypass hostname validation . Lets username is admin and password is password123@ and hostname is 127.0.0.1 . so the url will be...

Directory traversal

SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal in conjunction with CVE-2019-14511 because the mysql client can be used for CALL SNIPPETS and loadfile operations on a full pathname e.g., a file in the /etc directory. NOTE: this is unrelated to CMUSphinx...

CVE-2021-45463

loadcache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIM...

CVE-2021-45463

loadcache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIM...