54 matches found
CVE-2025-25284
The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS Web Processing Service implementation allows unauthorized access to files outside the intended directory through path traversal. Specifically, the GdalTranslate service, whe...
CVE-2025-25284 Path Traversal and Local File Read via VRT (Virtual Format) in ZOO-Project WPS Implementation
The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS Web Processing Service implementation allows unauthorized access to files outside the intended directory through path traversal. Specifically, the GdalTranslate service, whe...
CVE-2025-25284 Path Traversal and Local File Read via VRT (Virtual Format) in ZOO-Project WPS Implementation
The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS Web Processing Service implementation allows unauthorized access to files outside the intended directory through path traversal. Specifically, the GdalTranslate service, whe...
CVE-2025-25284 Path Traversal and Local File Read via VRT (Virtual Format) in ZOO-Project WPS Implementation
The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS Web Processing Service implementation allows unauthorized access to files outside the intended directory through path traversal. Specifically, the GdalTranslate service, whe...
PT-2025-7067 · Unknown · Zoo-Project
Name of the Vulnerable Software and Affected Versions: ZOO-Project affected versions not specified Description: A vulnerability in the ZOO-Project's WPS implementation allows unauthorized access to files outside the intended directory through path traversal. Specifically, the Gdal Translate...
vrt-info.de Cross Site Scripting vulnerability OBB-3847951
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Malicious code in vrt-mediaplayer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5beb7bbe760c6fff446c9c3f4389622040e0e1070219e4d6d7f1a4131ef936df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6971 Malicious code in vrt-mediaplayer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5beb7bbe760c6fff446c9c3f4389622040e0e1070219e4d6d7f1a4131ef936df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
gdal:gdal_vrt_fuzzer: Heap-buffer-overflow in NC4_inq_var_all
Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5005743774892032 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: gdalvrtfuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x602000016238...
DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - Email notification is not being sent while changing passwords
Email notification was not sent while changing passwords. This issue was fixed. Best Practices As recommended practices, Due to missing notification email when changing password, If the password has been maliciously changed, the user will not be able to notice it, so immediate security measures...
CVE-2018-18657
An issue was discovered in Arcserve Unified Data Protection UDP through 6.5 Update 4. There is a DDI-VRT-2018-18 Unauthenticated Sensitive Information Disclosure via /gateway/services/EdgeServiceImpl issue...
CVE-2018-18659
An issue was discovered in Arcserve Unified Data Protection UDP through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue...
Cross site scripting
An issue was discovered in Arcserve Unified Data Protection UDP through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue...
Information disclosure
An issue was discovered in Arcserve Unified Data Protection UDP through 6.5 Update 4. There is a DDI-VRT-2018-18 Unauthenticated Sensitive Information Disclosure via /gateway/services/EdgeServiceImpl issue...
Code injection
An issue was discovered in Arcserve Unified Data Protection UDP through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue...
CVE-2018-18660
An issue was discovered in Arcserve Unified Data Protection UDP through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue...
CVE-2018-18658
An issue was discovered in Arcserve Unified Data Protection UDP through 6.5 Update 4. There is a DDI-VRT-2018-20 Unauthenticated Sensitive Information Disclosure via /UDPUpdates/Config/FullUpdateSettings.xml issue...
CVE-2018-18660
Arcserve UDP (Arcserve Unified Data Protection) up to 6.5 Update 4 is affected by a reflected Cross-Site Scripting (XSS) in /authenticationendpoint/domain.jsp (DDI-VRT-2018-21). Root cause is input handling leading to script injection; this is a client-side vulnerability that could affect users i...
CVE-2018-18657
Arcserve UDP up to 6.5 Update 4 is affected by an unauthenticated information disclosure via the EdgeServiceImpl endpoint (/gateway/services/EdgeServiceImpl). The issue, DDI-VRT-2018-18, allows disclosure of sensitive information without authentication. Affected product: Arcserve Unified Data Pro...