Threats tagged 'ghsa-p9pj-xp4g-3h2q'

A path traversal vulnerability exists in the tftpsync/add and tftpsync/delete scripts that allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. The endpoint is unauthenticated but access is limited to a list of allowed IP addresses.