CVE-2020-7953

CVE-2020-7953 affects OpServices OpMon 9.3.2. The issue allows reading server files (e.g., /etc/passwd) without authentication due to the use of nmap -iL (input file) option. Multiple connected sources (including Red Hat and CNVD entries) corroborate this description. The vulnerability impacts co...

CVE-2020-3938

SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests...

Squiz Matrix CMS Arbitrary File Deletion Vulnerability

Squiz Matrix CMS is an open source content management system with a highly usable interface. An arbitrary file deletion vulnerability exists in core/assets/form/form/formquestiontypes/formquestiontypefileupload/formquestiontypefileupload.inc in Squiz Matrix CMS. An attacker can exploit this...

The vulnerability of the Jackson-databind library, related to the lack of protection for service data, allows attackers to read arbitrary files on the server.

The vulnerability of the Jackson-databind library is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files on the server by sending a specially crafted JSON message...

The vulnerability of the Jackson-databind library, related to the lack of protection for service data, allows a hacker to read arbitrary files on the server.

The vulnerability of the Jackson-databind library is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files on the server using a specially created JSON message...

Arbitrary File Deletion Vulnerability in HkCMS

HkCMS has been committed to providing free and open source content management system for enterprise station building, HkCMS has excellent expansion and secondary development capabilities, can be adapted to enterprise lightweight system development and deployment. HkCMS arbitrary file deletion...

Arbitrary File Deletion Vulnerability in LeShang Mall

LeShares is a lightweight mall website management system, based on Thinkphp5+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other various platforms. LeShang Mall arbitrary file deletion vulnerability, an attacker can use this vulnerability to arbitrarily delete server files...

GHSA-X4W5-R546-X9QH Arbitrary File Read in html-pdf

All versions of html-pdf are vulnerable to Arbitrary File Read. The package fails to sanitize the HTML input, allowing attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. Input with an XHR request such as...

Path Traversal

Overview All versions of @wturyn/swagger-injector are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured dist folder using relative paths. Recommendation No fix is currently available. Consider using an alternative...

GHSA-CGJV-RGHQ-QHGP Path Traversal in algo-httpserv

Versions of algo-httpserv prior to 1.1.2 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to version 1.1.2 or later...

Path Traversal in algo-httpserv

Versions of algo-httpserv prior to 1.1.2 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to version 1.1.2 or later...

Path Traversal

Overview All versions of statichttpserver are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a...

Path Traversal in statichttpserver

All versions of statichttpserver are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix is ma...

Arbitrary File Read

Overview html-pdf before version 3.0.1 is vulnerable to Arbitrary File Read. The package fails to sanitize the HTML input, allowing attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. Input with an XHR request such as...

Path Traversal

Overview All versions of f-serv are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative package until a fix is made...

Directory traversal

LINAGORA hublin latest commit 72ead897082403126bf8df9264e70f0a9de247ff is affected by: Directory Traversal. The impact is: The vulnerability allows an attacker to access any file with a fixed extension on the server. The component is: A web-view renderer; details here:...

CVE-2019-1010205

LINAGORA hublin latest commit 72ead897082403126bf8df9264e70f0a9de247ff is affected by: Directory Traversal. The impact is: The vulnerability allows an attacker to access any file with a fixed extension on the server. The component is: A web-view renderer; details here:...

GHSA-2MP5-M968-GWR2 Path Traversal in http-file-server

All versions of http-file-server are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix is ma...

PT-2019-17676 · Unknown · Http File Server

Name of the Vulnerable Software and Affected Versions: http-file-server versions = 0.2.6 Description: A path traversal issue allows attackers to list files in arbitrary folders. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relati...

Path Traversal in serve-here.js

Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 1.2.0 or later...