(Pwn2Own) Synology DiskStation Manager Serv.php Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Synology DiskStation Manager. This vulnerability does not require authentication, but does require some user interaction. The specific flaw exists within the Serv.php endpoint. The issue results from...

PT-2021-10834

Name of the Vulnerable Software and Affected Versions webTareas version 2.0 Description A Path Traversal issue exists via the extpath parameter in general serv.php, which could let a malicious user read arbitrary files. Recommendations For webTareas version 2.0, consider restricting access to the...