Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
659 results · page 10 of 14
Jan 22, 2024CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command.CVE-2020-36772 · Other software · Cloudlinux OS · reported by Red HatMedium 4.4
CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.
- Product
- cagefs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 10, 2024The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“roCVE-2023-48249 · Other software · Rexroth · reported by psirt@bosch.comMedium 6.5
The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crCVE-2023-48246 · Other software · Rexroth · reported by psirt@bosch.comMedium 6.5
The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafCVE-2023-48243 · Other software · Rexroth · reported by psirt@bosch.comHigh 8.1
The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 10, 2024The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“CVE-2023-48242 · Other software · Rexroth · reported by psirt@bosch.comMedium 6.5
The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request.
- Product
- Nexo cordless nutrunner NXA015S-36V (0608842001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 3, 2024In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.CVE-2023-46308 · Other software · Plotly · reported by MITRECritical 9.8
In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.
- Product
- Plotly.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.CVE-2023-7114 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comHigh 7.1
Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Dec 26, 2023Hotel Booking Lite: Does not validate file paths provided via user inputCVE-2023-5991 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
- Product
- Hotel Booking Lite
- Fixed in
- 4.8.5
- What to do
- Update Hotel Booking Lite to 4.8.5 or newer.
Dec 18, 2023SiteOrigin Widgets Bundle: Does not validate user input before using it to generate paths passed to include function/sCVE-2023-6295 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
- Product
- SiteOrigin Widgets Bundle
- Fixed in
- 1.51.0
- What to do
- Update SiteOrigin Widgets Bundle to 1.51.0 or newer.
Dec 7, 2023An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be usCVE-2023-50164 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlists.apache.org
Nov 30, 2023The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services CVE-2023-6352 · Other software · Aquaforest · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 5.3
The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services (IIS) or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate files or directories, traverse directories, bypass authentication, or access restricted files.
- Product
- TIFF Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaquaforest.com
Nov 28, 2023Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote coCVE-2023-4222 · Other software · Chamilo · reported by info@starlabs.sgHigh 7.2
Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote codCVE-2023-4221 · Other software · Chamilo · reported by info@starlabs.sgHigh 7.2
Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2023Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths.CVE-2023-41790 · Other software · Pandora FMS · reported by security@pandorafms.comHigh 7.6
Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows to access the server configuration file and to compromise the database. This issue affects Pandora FMS: from 700 through 773.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Nov 23, 2023Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths.CVE-2023-41787 · Other software · Pandora FMS · reported by security@pandorafms.comMedium 6
Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows access to files with sensitive information. This issue affects Pandora FMS: from 700 through 772.
- Product
- Pandora FMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpandorafms.compandorafms.com
Nov 15, 2023FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directorCVE-2023-5245 · Other software · Combust · reported by reefs@jfrog.comHigh 7.5
FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply() function invokes the vulnerable implementation of FileUtil.extract(). Arbitrary file creation can directly lead to code execution
- Product
- Mleap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.jfrog.com
Nov 9, 2023The filepath package does not recognize paths with a \??\ prefix as special.CVE-2023-45283 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
- Product
- path/filepath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Awesome Support: Does not sanitize file pathsCVE-2023-5355 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.
- Product
- Awesome Support
- Fixed in
- 6.1.5
- What to do
- Update Awesome Support to 6.1.5 or newer.
Nov 6, 2023Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notationCVE-2023-45827 · Other software · clickbar · reported by GitHubHigh 7.3
Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability.
- Product
- dot-diver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2023iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs.CVE-2023-46321 · Other software · iterm2 · reported by MITRECritical 9.8
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line.
- Product
- iterm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2023Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects.CVE-2023-39332 · Other software · NodeJS · reported by support@hackerone.comCritical 9.8
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
- Product
- Node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.fedoraproject.org
Oct 16, 2023WordPress Gallery: Does not validate some block attributes before using them to generate paths passed to include function/sCVE-2023-3279 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
- Product
- WordPress Gallery
- Fixed in
- 3.39
- What to do
- Update WordPress Gallery to 3.39 or newer.
Oct 4, 2023Make Paths Relative: Cross-Site Request Forgery (CSRF)CVE-2023-27433 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Make Paths Relative allows Cross Site Request Forgery.This issue affects Make Paths Relative: from n/a through 1.3.0.
- Product
- Make Paths Relative
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Make Paths Relative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 20, 2023Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernelCVE-2023-2163 · Computers, phones & browsers · Linux · reported by cve-coordination@google.comCritical 10
Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orgbughunters.google.com
Aug 22, 2023A Use After Free vulnerability in svg_dev_text_span_as_paths_defs function in source/fitz/svg-device.c in Artifex Software MuPDF 1.16.0 allows remote attackers CVE-2020-21896 · Other software · Artifex · reported by MITREMedium 5.5
A Use After Free vulnerability in svg_dev_text_span_as_paths_defs function in source/fitz/svg-device.c in Artifex Software MuPDF 1.16.0 allows remote attackers to cause a denial of service via opening of a crafted PDF file.
- Product
- Mupdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordghostscript.combugs.ghostscript.com
Aug 3, 2023 External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements wCVE-2023-0956 · Other software · TEL-STER · reported by ics-cert@hq.dhs.govHigh 7.5
External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.
- Product
- TelWin SCADA WebInterface
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2023ND Shortcodes: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2023-1273 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
- Product
- ND Shortcodes
- Fixed in
- 7.0
- What to do
- Update ND Shortcodes to 7.0 or newer.
May 30, 2023Otter: Does not sanitize some user-controlled file paths before performing file operations on themCVE-2023-2288 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
- Product
- Otter
- Fixed in
- 2.2.6
- What to do
- Update Otter to 2.2.6 or newer.
May 30, 2023imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation.CVE-2023-34204 · Other software · Imapsync Project · reported by MITREMedium 6.5
imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-writable, and thus (for example) an attacker can modify imapsync's cache and overwrite files belonging to the user who runs it.
- Product
- Imapsync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhausCVE-2021-46755 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhaust the SysHub resources resulting in a potential denial of service.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023The file download facility doesn't sufficiently sanitize file paths in certain situations.CVE-2023-31250 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023Pricing Tables For WPBakery Page Builder (formerly Visual Composer): Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2023-1274 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
- Product
- Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
- Fixed in
- 3.0
- What to do
- Update Pricing Tables For WPBakery Page Builder (formerly Visual Composer) to 3.0 or newer.
Apr 10, 2023WP Meta SEO: Does not validate image file paths before attempting to manipulate the image filesCVE-2023-1381 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution.
- Product
- WP Meta SEO
- Fixed in
- 4.5.5
- What to do
- Update WP Meta SEO to 4.5.5 or newer.
Full record and what to do →NVD recordblog.wpscan.comwpscan.com
Feb 16, 2023In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp.CVE-2023-23558 · Other software · Eternal Terminal Project · reported by MITREMedium 6.3
In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver with mode 0777 before the etserver process is started. The attacker can choose to read sensitive information from that file, or modify the information in that file.
- Product
- Eternal Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.suse.com
Feb 8, 2023IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths.CVE-2022-42438 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM X-Force ID: 238210.
- Product
- Cloud Pak for Multicloud Management Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 17, 2023RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files.CVE-2022-2893 · Other software · RONDS · reported by ics-cert@hq.dhs.govHigh 8.2
RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files.
- Product
- Equipment Predictive Maintenance Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2023SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks.CVE-2022-36943 · Other software · ZipArchive · reported by cve-assign@fb.comHigh 8.1
SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.
- Product
- SSZipArchive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36566 · Other software · github.com/whyrusleeping/tar-utils · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/whyrusleeping/tar-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36561 · Other software · github.com/yi-ge/unzip · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/yi-ge/unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36560 · Other software · github.com/artdarek/go-unzip · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/artdarek/go-unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2018-25046 · Other software · code.cloudfoundry.org/archiver · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- code.cloudfoundry.org/archiver/extractor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths thaCVE-2022-31739 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 15, 2022An issue existed with the file paths used to store website data.CVE-2022-32833 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
An issue existed with the file paths used to store website data. The issue was resolved by improving how website data is stored. This issue is fixed in iOS 16. An unauthorized user may be able to access browsing history.
- Product
- iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 25, 2022Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program.CVE-2022-41158 · Other software · eyoom Co.,Ltd · reported by vuln@krcert.or.krHigh 7.2
Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code.
- Product
- eyoom builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Nov 10, 2022HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs CVE-2022-3866 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.
- Product
- Nomad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Nov 7, 2022Import any XML or CSV File to: Is not validating the paths of files contained in uploaded zip archivesCVE-2022-2711 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.9
- What to do
- Update Import any XML or CSV File to to 3.6.9 or newer.
Nov 1, 2022A parsing issue in the handling of directory paths was addressed with improved path validation.CVE-2022-32938 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. A shortcut may be able to check the existence of an arbitrary path on the file system.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Sep 5, 2022The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file.CVE-2022-3008 · Other software · syoyo · reported by cve-coordination@google.comHigh 8.1
The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751
- Product
- tinygltf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Aug 10, 2022Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential dirCVE-2022-29804 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
- Product
- path/filepath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2022Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows unauthenticated attackers to view internal paths and scripts via web files.CVE-2022-34535 · Other software · DW · reported by MITREHigh 7.5
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows unauthenticated attackers to view internal paths and scripts via web files.
- Product
- Megapix Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.