CVE-2022-31520: Improper Limitation of a Pathname to a Restricted Directory

The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31526: Improper Limitation of a Pathname to a Restricted Directory

The ThundeRatz/ThunderDocs repository through 2020-05-01 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31586: Improper Limitation of a Pathname to a Restricted Directory

The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

PT-2022-20806

Name of the Vulnerable Software and Affected Versions freefood89/Fishtank repository through 2015-06-24 Description The issue allows absolute path traversal due to the unsafe use of the Flask send file function. Recommendations For the freefood89/Fishtank repository through 2015-06-24, consider...

CVE-2022-31560: Improper Limitation of a Pathname to a Restricted Directory

The uncleYiba/phototag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-1554

CVE-2022-1554 affects the Python package scout (clinical-genomics/scout) prior to version 4.52. The underlying issue is a path traversal vulnerability caused by a send_file/end_file usage, exposing potential unauthorized access to files. Exploitation or real-world details are not provided in the ...

CVE-2022-1554 Path Traversal due to `send_file` call in clinical-genomics/scout

Path Traversal due to sendfile call in GitHub repository clinical-genomics/scout prior to 4.52...

CVE-2022-1554

Path Traversal due to sendfile call in GitHub repository clinical-genomics/scout prior to 4.52...

CVE-2022-1554: Absolute Path Traversal

Path Traversal due to sendfile call in GitHub repository clinical-genomics/scout prior to 4.52...

CVE-2022-24900

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The os.path.join call is unsafe for use with untrusted input. When the os.path.join call encounters an absolute...

CVE-2022-24900 Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The os.path.join call is unsafe for use with untrusted input. When the os.path.join call encounters an absolute...

Ruby on Rails: Regex Injection from request header (Rack::Sendfile, send_file)

I have confirmed that Rack::Sendfile and the Rails sendfile that handles it have a problem handling custom headers for request. It is expected that the X-Sendfile-type and X-Accel-Mapping headers will be sent from nginx, but these headers can also be sent from a user agent such as a browser. This...