Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb

✍️ Description Hello dear Rdiffweb team. I found a CSRF vulnerability on following endpoint that attackers able to Delete users with PoC.html 🕵️‍♂️ Proof of Concept 1. user with right privileges should be logged in Firefox or Safari. 2. Users go to a website that contain PoC.html 3.after visiting...

rdiffweb 0.3.5 - Directory Traversal vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24092/info rdiffWeb is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable...

rdiffweb 0.3.5 - Directory Traversal

rdiffweb 0.3.5 - Directory Traversal source: https://www.securityfocus.com/bid/24092/info rdiffWeb is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable...

rdiffweb 0.3.5 - Directory Traversal

source: https://www.securityfocus.com/bid/24092/info rdiffWeb is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserve...

CVE-2007-2747

Directory traversal vulnerability in rdwhelpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read arbitrary files via a .. dot dot in the path parameter to the /browse URI...

CVE-2007-2747

CVE-2007-2747 : A directory traversal vulnerability in rdifWeb’s rdw_helpers.py (rdiffWeb) before version 0.3.5.1 allows remote attackers to read arbitrary files by supplying a .. (dot dot) path in the /browse URI. The underlying flaw is a lack of proper path sanitization, enabling traversal beyo...