CVE-2024-45178

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, du...

CVE-2024-45175

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive information, for example login credentials of cameras, is stored in cleartext. Thus, an attacker with filesystem access, for example exploiting a...

CVE-2024-45178

CVE-2024-45178 affects za-internet C-MOR Video Surveillance 5.2401. The issue is path traversal caused by insufficient input validation, enabling an authenticated user to download arbitrary files as user www-data via vulnerable scripts download-bkf.pml (parameter bkf) and show-movies.pml (paramet...

CVE-2024-45175

The CVE-2024-45175 affects za-internet C-MOR Video Surveillance (versions 5.2401 and 6.00PL01 per SYSS advisory and PacketStorm). The root cause is cleartext storage of sensitive data (e.g., camera login credentials), which can be accessed by an attacker with filesystem access (e.g., via path tra...

CVE-2024-45178

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, du...

Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

Impact The export download route /filament-excel/path allowed downloading any file without login when the webserver allows ../ in the URL. Patches Patched with Version v2.3.3 Credits Thanks to Kevin Pohl for reporting this...

GHSA-M3PX-VJXR-FX4M Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

Impact The export download route /filament-excel/path allowed downloading any file without login when the webserver allows ../ in the URL. Patches Patched with Version v2.3.3 Credits Thanks to Kevin Pohl for reporting this...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-40422

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

CVE-2024-40422

CVE-2024-40422 concerns path traversal in the Devika v1 snapshot API. Affected: stitionai devika version v1, endpoint /api/get-browser-snapshot. Root cause: manipulation of the snapshot_path parameter lets an attacker traverse directories and access sensitive server files, enabling confidentialit...

CVE-2024-22231

Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master...

CVE-2024-5187

A vulnerability in the downloadmodelwithtestdata function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system,...

PT-2024-24518 · Unknown +1 · Gaizhenbiao/Chuanhuchatgpt +1

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt versions prior to the fixed version released on 20240305 Description: The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. This...

Rocky Linux 9 : nodejs:20 (RLSA-2024:1688)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1688 advisory. - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For exampl...

CVE-2024-34033

Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten...

CVE-2024-34033

Delta Electronics DIAEnergie is affected by a Path Traversal (CWE-22) due to insufficient input validation, allowing an attacker to write files outside the intended directory. Public references indicate affected DIAEnergie versions include v1.10.00.005, with remediation available in v1.10.01.004....

CVE-2024-34033 Path Traversal vulnerability in Delta Electronics DIAEnergie

Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten...

CVE-2024-31965

The CVE-2024-31965 affects Mitel 6800 Series, 6900 Series SIP phones (through 6.3 SP3 HF4), 6900w Series SIP Phone (through 6.3.3), and 6970 Conference Unit (through 5.1.1 SP8). The root cause is insufficient input validation that enables an authenticated attacker with administrative privileges t...

CVE-2024-31965

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct a path traversal attack due to insufficient input...