CWE-23 vulnerabilities

PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.

IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper neutralization of pathname input.

A missing protection against path traversal allows to access any file on the server.

aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part,

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13. As a workaround, users can edit the `cmd_config.json` file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later to fully resolve this issue.

The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information.

CVE-2025-27610 is a high-severity path traversal vulnerability in the Ruby web application interface Rack, specifically in the Rack::Static component. Versions prior to 2.2.13, 3.0.14, and 3.1.12 do not properly sanitize user-supplied paths, allowing attackers to access files outside the intended static directory. This occurs due to improper validation of encoded path traversal sequences. The issue is patched in versions 2.2.13, 3.0.14, and 3.1.12. Mitigations include upgrading to these fixed versions, removing Rack::Static usage, or restricting the root directory to only public files. Use of external static file servers or CDNs may also reduce risk.

IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 is vulnerable to local file inclusion vulnerability, allowing an attacker to access sensitive files by inserting path traversal payloads inside the deficon parameter.

Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVE-2024-43614 is a relative path traversal vulnerability in Microsoft Defender for Endpoint for Linux. It allows an authorized local attacker to perform spoofing attacks by manipulating file paths. The vulnerability affects versions from 101.0.0 up to but not including 101.24052.0002. Microsoft has released an official fix in version 101.24052.0002. The CVSS 3.1 base score is 5.5, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

Windows Remote Desktop Licensing Service Information Disclosure Vulnerability

CVE-2024-27199 is a path traversal vulnerability in JetBrains TeamCity versions before 2023.11.4. This flaw allows an unauthenticated attacker to perform limited administrative actions by exploiting improper input validation of file paths. The vulnerability has a CVSS score of 7.3, indicating high severity, with potential impacts on confidentiality, integrity, and availability. No official patch link is provided in the data, but the fixed version is identified as 2023.11.4. There are no known exploits in the wild at this time.