Threats Tagged 'cwe-23'

Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally.

Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

CVE-2026-5422 is a path traversal vulnerability in jupyter-server version 2.17.0. It arises from an improper root directory boundary check in the _get_os_path() function, which uses a startswith check without a trailing path separator. This allows sibling directories with similar prefixes to bypass the check. Additionally, the to_os_path() function does not remove '.. ' path parts, enabling traversal sequences to circumvent protections. This can lead to unauthorized read/write access to files in sibling directories, risking exposure of sensitive data in shared hosting environments.

DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing privileged local attackers to exploit Relative Path Traversal to download arbitrary system files.

DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing unauthenticated local attackers to exploit Relative Path Traversal to download arbitrary system files.

Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing arbitrary files in all directories as root. This leads to RCE. The affected component is the RDP drive redirection.  Depending on implementation, the vulnerability can be exploited by an unauthenticated attacker. This issue affects SparkView: before build 1127.

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured and file compression is enabled.

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to read arbitrary files from the device.