CVE-2018-7632

Buffer Overflow in httpd in EpiCentro E7.3.2+ allows attackers to cause a denial of service attack remotely via a specially crafted GET request with a leading "/" in the URL...

PT-2018-12926 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions prior to 0.12 Description: The issue allows remote attackers to redirect users to arbitrary websites, potentially leading to phishing attacks. This is achieved via an initial / substring in the redirect to parameter. The...

DEBIAN-CVE-2017-16654

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

CVE-2017-16654

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

UBUNTU-CVE-2018-14363

An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames...

DEBIAN-CVE-2018-14362

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character...

UBUNTU-CVE-2018-14362

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character...

DEBIAN-CVE-2018-14036

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in userchangeiconfileauthorizedcb in user.c...

Slack: SSRF in api.slack.com, using slash commands and bypassing the protections.

Bypassing the reports 61312 and 356765 Tutorial: Go to api.slack.com and create an application with your own slash command. F320014 Enter your own domain: in your own domain: index.php location: http://:::22/ F320019 And save. Go to your Slack and type /youslash Try with my server...

goserv directory traversal vulnerability

goserv is an HTTP server. A directory traversal vulnerability exists in goserv. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

f2e-server path traversal vulnerability

f2e-server is an HTTP server based on the Node.js platform . A path traversal vulnerability exists in f2e-server version 1.12.11 and earlier. An attacker can exploit this vulnerability by placing a '... /' sequence into a URL to gain access to the file system...

mfrs directory traversal vulnerability

mfrs is a static file server. A directory traversal vulnerability exists in mfrs. An attacker can exploit this vulnerability by placing "... /" in a URL to access the file system...

uekw1511server Directory Traversal Vulnerability

uekw1511server is a static file server. A directory traversal vulnerability exists in uekw1511server. An attacker can exploit this vulnerability by placing a '... /' sequence in a URL to gain access to the file system...

intsol-package directory traversal vulnerability

intsol-package is a file server. A directory traversal vulnerability exists in intsol-package. An attacker can exploit this vulnerability by placing ". /" in a URL to access the file system...

22lixian Directory Traversal Vulnerability

22lixian is a simple file server. 22lixian suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability by placing "... /" in a URL to access the file system...

Fast-http-cli Directory Traversal Vulnerability

fast-http-cli is a command-line based HTTP server. A directory traversal vulnerability exists in fast-http-cli. An attacker can exploit this vulnerability by placing a '. /' sequence in a URL to gain access to the file system...

CVE-2017-16150

wanggoujing123 is a simple webserver. wanggoujing123 is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16147

shit-server is a file server. shit-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

Slack: Internal SSRF bypass using slash commands at api.slack.com

@albatraoz found a bypass to report 61312, allowing information leakage via SSRF in Slash commands. We fixed the vulnerability and performed a through investigation. Thanks @albatraoz!...

Node.js third-party modules: [serve] Directory listing and File access even when they have been set to be ignored (using dot-slash)

I would like to report a vulnerability in serve. It allows listing directory and reading local files on the target server. Module module name: serve version: 6.5.3 npm page: https://www.npmjs.com/package/serve Module Description Ever wanted to share a project on your network by running just a...