Incomplete in the CWE catalog · 13 CVEs mapped
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.
SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726.
Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem. Version 2.1.4 fixes the issue.
🚨 A sneaky directory traversal vulnerability in Riello UPS NetMan 208 could allow attackers to upload files and execute code - all through a simple misstep! 🔥 Think of it like a delivery person being handed the wrong address—if they follow the instructions without double-checking, they might drop off a package at a very sensitive location! An attacker could exploit this flaw to upload malicious files and execute arbitrary code on the UPS management system, leading to total control over the device. This means they could disrupt operations, steal sensitive data, or even cause physical damage to connected equipment. The consequences could be absolutely devastating!