CVE-2022-31193

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a...

U.S. Dept Of Defense: [Critical] Full local fylesystem access (LFI/LFD) as admin via Path Traversal in the misconfigured Java servlet on the https://███/

Description Hello. I discovered a Path Traversal issue on the https://██████████/ I was able to turn it to the local file read, and after series of the test determined that it's possible to reach sensitive system files with administrator rights. POC The next request will read the...

NetGain Enterprise Manager Arbitrary File Deletion Vulnerability

Netgain Enterprise Manager is a suite of IT asset monitoring and management software from NetGain Systems, Singapore. A directory traversal vulnerability exists in the org.apache.jsp.u.jsp.reports.templates.misc.samplejsp servlet in NetGain Enterprise Manager, which originates from a process that...