CVE-2022-1554

CVE-2022-1554 affects the Python package scout (clinical-genomics/scout) prior to version 4.52. The underlying issue is a path traversal vulnerability caused by a send_file/end_file usage, exposing potential unauthorized access to files. Exploitation or real-world details are not provided in the ...

CVE-2022-1554 Path Traversal due to `send_file` call in clinical-genomics/scout

Path Traversal due to sendfile call in GitHub repository clinical-genomics/scout prior to 4.52...

CVE-2022-1554

Path Traversal due to sendfile call in GitHub repository clinical-genomics/scout prior to 4.52...

CVE-2022-1554: Absolute Path Traversal

Path Traversal due to sendfile call in GitHub repository clinical-genomics/scout prior to 4.52...

CVE-2022-24900

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The os.path.join call is unsafe for use with untrusted input. When the os.path.join call encounters an absolute...

CVE-2022-24900 Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer

Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The os.path.join call is unsafe for use with untrusted input. When the os.path.join call encounters an absolute...

Ruby on Rails: Regex Injection from request header (Rack::Sendfile, send_file)

I have confirmed that Rack::Sendfile and the Rails sendfile that handles it have a problem handling custom headers for request. It is expected that the X-Sendfile-type and X-Accel-Mapping headers will be sent from nginx, but these headers can also be sent from a user agent such as a browser. This...