KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps…
Przechodzenie przez katalogi w Citrix ADC i Gateway umożliwia dostęp do nieautoryzowanych plików.
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download…
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default…
A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default…
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version…
Wielokrotne luki w przechodzeniu katalogów w konsoli administratora Adobe ColdFusion pozwalają na zdalne odczytanie plików.
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Wykorzystanie podatności w SysAid umożliwia zdalne wykonanie kodu przez atakującego.
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue…
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Luka w NuPoint Unified Messaging umożliwia atak path traversal i nieautoryzowany dostęp do danych.
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path…
Obejście uwierzytelnienia w Zimbra Collaboration Suite pozwala na zdalne wykonanie kodu.
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or…
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous…
Wrażliwość na przejście ścieżki w WinRAR na Windows umożliwia wykonanie dowolnego kodu.
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup…
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Luka w Cisco ASA i FTD umożliwia zdalnemu atakującemu odczyt wrażliwych plików.
Luka w interfejsie webowym Cisco ASA pozwala na zdalne wywołanie awarii urządzenia.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Certain WSO2 products allow unrestricted file upload with resultant remote code execution. | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps… |
Pilne działanie | 9,8 | 100 % | ||
| Przechodzenie przez katalogi w Citrix ADC i Gateway umożliwia dostęp do nieautoryzowanych plików. | Przechodzenie przez katalogi w Citrix ADC i Gateway umożliwia dostęp do nieautoryzowanych plików. |
Pilne działanie | 9,8 | 100 % | ||
| An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and… | An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download… |
Pilne działanie | 9,8 | 100 % | ||
| A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. | A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default… |
Pilne działanie | 9,8 | 99,99 % | ||
| A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version… | A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication. |
Pilne działanie | 9,8 | 99,98 % | ||
| It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. | It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default… |
Pilne działanie | 9,8 | 99,96 % | ||
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache… | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue. |
Pilne działanie | 9,8 | 99,92 % | ||
| The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before… | The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version… |
Pilne działanie | 9,8 | 99,91 % | ||
| Wielokrotne luki w przechodzeniu katalogów w konsoli administratora Adobe ColdFusion pozwalają na zdalne odczytanie plików. | Wielokrotne luki w przechodzeniu katalogów w konsoli administratora Adobe ColdFusion pozwalają na zdalne odczytanie plików. |
Pilne działanie | 9,8 | 99,75 % | ||
| Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a… | Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request. |
Pilne działanie | 9,8 | 99,03 % | ||
| Wykorzystanie podatności w SysAid umożliwia zdalne wykonanie kodu przez atakującego. | Wykorzystanie podatności w SysAid umożliwia zdalne wykonanie kodu przez atakującego. |
Pilne działanie | 9,8 | 98,85 % | ||
| The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that,… | The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue… |
Pilne działanie | 10,0 | 97,6 % | ||
| Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. |
Pilne działanie | 9,1 | 98,61 % | ||
| Luka w NuPoint Unified Messaging umożliwia atak path traversal i nieautoryzowany dostęp do danych. | Luka w NuPoint Unified Messaging umożliwia atak path traversal i nieautoryzowany dostęp do danych. |
Pilne działanie | 9,1 | 98,11 % | ||
| An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. | An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. |
Pilne działanie | 9,8 | 93,02 % | ||
| MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write… | MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface. |
Pilne działanie | 9,1 | 95,98 % | ||
| Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. | Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path… |
Pilne działanie | 8,8 | 97,03 % | ||
| Obejście uwierzytelnienia w Zimbra Collaboration Suite pozwala na zdalne wykonanie kodu. | Obejście uwierzytelnienia w Zimbra Collaboration Suite pozwala na zdalne wykonanie kodu. |
Pilne działanie | 9,8 | 91,89 % | ||
| A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through… | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or… |
Pilne działanie | 9,8 | 91,84 % | ||
| An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. | An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous… |
Pilne działanie | 9,8 | 91,25 % | ||
| Wrażliwość na przejście ścieżki w WinRAR na Windows umożliwia wykonanie dowolnego kodu. | Wrażliwość na przejście ścieżki w WinRAR na Windows umożliwia wykonanie dowolnego kodu. |
Pilne działanie | 8,8 | 94,26 % | ||
| Openfire is an XMPP server licensed under the Open Source Apache License. | Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup… |
Pilne działanie | 7,5 | 100 % | ||
| Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a… | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. |
Pilne działanie | 7,5 | 99,99 % | ||
| Luka w Cisco ASA i FTD umożliwia zdalnemu atakującemu odczyt wrażliwych plików. | Luka w Cisco ASA i FTD umożliwia zdalnemu atakującemu odczyt wrażliwych plików. |
Pilne działanie | 7,5 | 99,99 % | ||
| Luka w interfejsie webowym Cisco ASA pozwala na zdalne wywołanie awarii urządzenia. | Luka w interfejsie webowym Cisco ASA pozwala na zdalne wywołanie awarii urządzenia. |
Pilne działanie | 7,5 | 99,91 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.