CVE-2025-32103

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions...

CVE-2024-29502

An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths...

CVE-2025-32103

CrushFTP is affected: versions 9.x through 11.3.1 contain a directory-traversal flaw accessible via the /WebInterface/function/ URI that can read files exposed by SMB UNC paths, bypassing SecurityManager restrictions. Impact: potential unauthorized reading of files outside the intended directory....

CVE-2025-32103

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions...

April 8, 2025-KB5055170 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1607 and Windows Server 2016

None None...

CVE-2024-42733

An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input...

CVE-2024-42733

An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input...

CVE-2024-42733

An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input...

CVE-2024-42733

An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input...

SUSE CVE-2024-38472

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new...

UBUNTU-CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

PT-2025-49180

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.30 through 2.4.65 Description An integer overflow occurs during failed ACME certificate renewal. After approximately 30 days of failures with default configurations, the backoff timer reaches zero. Subsequent...

SUSE CVE-2024-49766

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

CVE-2024-49766

A flaw was found in Werkzeug. In Python versions below v3.11 on Windows, os.path.isabs does not catch UNC paths such as //server/share. Werkzeug's safejoin relies on this check and can produce a path that is not safe, which can allow unintended access to data...

Werkzeug safe_join not safe on Windows

On Python = 3.11, or not using Windows, are not vulnerable...

Directory Traversal

Overview Werkzeug is a WSGI web application library. Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs, which allows the improper handling of UNC paths beginning with /, in the safejoin function. This allows an attacker to read some files on...

GHSA-F9VJ-2WH5-FJ8J Werkzeug safe_join not safe on Windows

On Python = 3.11, or not using Windows, are not vulnerable...

CVE-2024-49766 Werkzeug safe_join not safe on Windows

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

CVE-2024-49766 Werkzeug safe_join not safe on Windows

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

CVE-2024-49766 Werkzeug safe_join not safe on Windows

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...