CWE-22

{
  "affected": [],
  "aliases": [
    "CVE-2018-15141"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-08-13T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the \"docid\" parameter when the mode is set to delete.",
  "id": "GHSA-gvvw-2fw3-q5rv",
  "modified": "2022-05-14T02:45:26Z",
  "published": "2022-05-14T02:45:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15141"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openemr/openemr/pull/1765/files"
    },
    {
      "type": "WEB",
      "url": "https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45202"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2004-1991"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2004-05-03T04:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in Aldo\u0027s Web Server (aweb) 1.5 allows remote attackers to view arbitrary files via a .. (dot dot) in an HTTP GET request.",
  "id": "GHSA-gw25-cpw2-g3m4",
  "modified": "2022-04-29T03:00:35Z",
  "published": "2022-04-29T03:00:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-1991"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16048"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=108360629031227\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/11542"
    },
    {
      "type": "WEB",
      "url": "http://www.oliverkarow.de/research/AldosWebserverMultipleVulns.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/5881"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/10262"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260510110132-b763d787d1f2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T14:56:31Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\nSiYuan\u0027s `/export/` file handler was hardened against export disclosure (issue #12213) by adding an\n`IsSubPath(exportBaseDir, fullPath)` check and an `IsSensitivePath()` check in commit `bb481e1`. These guards\nwere added only to the main branch of the handler. The handler begins with a short-circuit branch:\n```go\nif strings.HasPrefix(c.Request.URL.Path, \"/export/temp/\") {\n    c.File(filepath.Join(util.TempDir, c.Request.URL.Path))\n    return\n}\n```\nThis branch joins the **broader** `util.TempDir` with the raw, percent-decoded request path and serves it with\n**neither** `IsSubPath` **nor** `IsSensitivePath`. An authenticated request to\n`/export/temp/%2e%2e/.../etc/passwd` traverses out of `TempDir` and reads arbitrary files - exactly the\nsensitive-file disclosure the patch intended to prevent. Present in the latest master.\n\n## Affected\n- From commit `bb481e1` (the hardening) through the latest master.\n- Requires SiYuan access authorization (`model.CheckAuth`) - but the patch\u0027s stated goal is to deny sensitive-file\n  export even to authorized callers.\n\n## Root cause\n`kernel/server/serve.go` `serveExport()`: the main branch has `IsSubPath` + `IsSensitivePath`; the\n`/export/temp/` short-circuit branch (above it) has neither and uses `util.TempDir` as its root.\n`c.Request.URL.Path` is percent-decoded by net/http, so `%2e%2e` becomes `..` and `filepath.Join` collapses it.\n\n## Incomplete-fix lineage\n- Export disclosure (issue #12213; CVE-2026-30869) -\u003e fix `bb481e1` / `d68bd5a` (GHSA-6865-qjcf-286f): guards on\n  the main branch + `IsSensitivePath` extended to `*.db`/`*.log`.\n- Follow-up CVE-2026-41894 (GHSA-hjh7-r5w8-5872) in the same `/export` path family.\n- The `/export/temp/` short-circuit branch was never covered by the guards (this report).\n\n## Proof of concept (benign)\n1. Authenticate (access auth code).\n2. `GET /export/\u003csensitive\u003e` (main branch) -\u003e 401/403 (guards work).\n3. `GET /export/temp/%2e%2e/%2e%2e/.../tmp/\u003cplanted-marker\u003e` (or `/etc/hostname`) -\u003e 200 + file content,\n   demonstrating the unguarded traversal. The PoC reads only a planted marker / `/etc/hostname`; no credentials.\n\n## Impact\nAuthenticated arbitrary file read bypassing the sensitive-file protection: `/etc/passwd`, `~/.ssh/*`, SiYuan\n`*.db` workspace data, `*.log`. \n\n## Remediation\n- Apply `IsSubPath` + `IsSensitivePath` to the `/export/temp/` branch (or restrict its root to `TempDir/temp` with\n  an `IsSubPath` check).\n- `filepath.Clean` the request path and reject `..`.\n- Merge both branches into one guarded file-serving function.\n\n## References\n- Hardening advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f (commit d68bd5a); issue #12213.\n- CVE chain: CVE-2026-30869 -\u003e CVE-2026-41894 (GHSA-hjh7-r5w8-5872).\n- serve.go guards commit: https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7\n- Residual source (master): `kernel/server/serve.go` `serveExport()` lines 308-312.",
  "id": "GHSA-gw25-m53r-qh88",
  "modified": "2026-09-03T14:56:31Z",
  "published": "2026-09-03T14:56:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gw25-m53r-qh88"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/b763d787d1f2b862c577049e4ee147c5857fe413"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.igniterealtime.openfire:xmppserver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.10.0"
            },
            {
              "fixed": "4.6.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.igniterealtime.openfire:xmppserver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.7.0"
            },
            {
              "fixed": "4.7.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-32315"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-23T19:54:30Z",
    "nvd_published_at": "2023-05-26T23:15:16Z",
    "severity": "HIGH"
  },
  "details": "An important security issue affects a range of versions of Openfire, the cross-platform real-time collaboration server based on the XMPP protocol that is created by the Ignite Realtime community. \n\n### Impact\nOpenfire\u0027s administrative console (the Admin Console), a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users.\n\n### Cause\nPath traversal protections were already in place to protect against exactly this kind of attack, but didn\u2019t defend against certain non-standard URL encoding for UTF-16 characters, that were not supported by the embedded webserver that was in use at the time.\n\nA later upgrade of the embedded webserver included support for non-standard URL encoding of UTF-16 characters. The path traversal protections in place in Openfire were not updated to include protection against this new encoding. \n\nOpenfire\u0027s API defines a mechanism for certain URLs to be excluded from web authentication (this, for example, is used for the login page). This mechanism allows for wildcards to be used, to allow for flexible URL pattern matching.\n\nThe combination of the wildcard pattern matching and path traversal vulnerability allows a malicious user to bypass authentication requirements for Admin Console pages.\n\n### Affected versions\nThis vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0).\n\n### Problem Reproduction\nTo test if an instance of Openfire is affected, follow these steps. Open a browser in incognito mode, or otherwise ensure that there is no authenticated session with the Openfire admin console. Open the following URL (possibly modified for the hostname of the server that is running Openfire):\n\n```http://localhost:9090/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp```\n\nIf this shows part of the openfire logfiles, then the instance of Openfire is affected by this vulnerability. Note that different versions of Openfire will show a different layout. Newer versions of Openfire can be expected to show log files on a dark background, while older versions will show a largely white page. (Depending on the content of the log file, this page might be empty, apart from a header!)\n\nIf there\u0027s a redirect to the login page, the instance is likely unaffected.\n\n### Problem Resolution\nThe problem has been patched in [Openfire release 4.7.5 and 4.6.8](https://www.igniterealtime.org/downloads/#openfire), and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0).\n\n- In Openfire 4.6.8, 4.7.5 and 4.8.0, Path Traversal pattern detection has been improved to include detection of non-standard URL encodings, preventing any non UTF-8 characters.\n- In Openfire 4.6.8, 4.7.5 and 4.8.0, a new configuration property (`adminConsole.access.allow-wildcards-in-excludes`) is introduced that controls the permissibility of using wildcards in URL-patterns that define exclusions to authentication.\n- In Openfire 4.6.8, 4.7.5 and 4.8.0, the existing value that uses a wildcard in URL-patterns that define exclusions to authentication has been replaced by values that do not depend on a wildcard.\n- In Openfire 4.6.8, 4.7.5 and 4.8.0, Setup-specific URL-patterns that define exclusions to authentication are no longer active after the setup process has finished.\n- In Openfire 4.8.0, the embedded webserver will be updated to a version that no longer supports the non-standard URL encoding of UTF-16 characters.\n- In Openfire 4.8.0, the embedded webserver that serves the Openfire administrative console will bind to the loopback network interface by default.\n\nBe aware that the new configuration properties can interfere with the functionality of certain Openfire plugins. This is especially true for plugins that bind a (web)endpoint to the embedded webserver that serves the Openfire administrative console, like current versions of the REST API plugin do. For these plugins to remain functional and/or reachable, it might be required to toggle the property `adminConsole.access.allow-wildcards-in-excludes` to `true`, and to avoid binding the embedded webserver to the loopback network interface only.\n\nWhen your server uses older versions of the following plugins, make sure to upgrade them:\n\n- [Random Avatar plugin](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=randomavatar), update to version 1.1.0 or later.\n- [Monitoring Service plugin](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=monitoring), update to version 2.5.0 or later.\n- [HTTP File Upload plugin](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=httpfileupload), update to version 1.3.0 or later.\n\n### Mitigation\nIf an Openfire upgrade isn\u2019t available for your release, or isn\u2019t quickly actionable, you can take any of the following steps to mitigate the risk for your Openfire environment.\n\nBe aware: through Openfire plugins, the effectiveness of some mitigations listed below can be reduced, while other mitigations might affect the functionality of plugins. Particular care should be taken when using the Monitoring Service plugin, REST API plugin, User Service plugin and/or Random Avatar plugin.\n\n#### Restrict network access\nUse network security measures (network ACLs and/or firewalls, VPNs) to ensure only trusted members of your community have access to the Openfire Admin Console. As a general rule, never expose the Openfire Admin Console to the general internet.\n\nExamples:\n* On a linux machine running `ufw`, deny ports 9090 and 9091 on non-loopback interfaces\n* On a Windows machine, restrict the rules that open ports 9090 and 9091 to only allow traffic from the IPv4 and/or IPv6 loopback addresses\n* On AWS cloud infrastructure, use EC2 Security Groups to restrict ports 9090 and 9091 to trusted IP addresses. If the trusted range is necessarily too broad, consider opening and closing the ports only as necessary\n* If using Docker, instead of `docker run ... -p 5222:5222 -p 9090:9090 -p 9091:9091 openfire` prevent remote access to the Admin Console with `docker run ... -p 5222:5222 -p 127.0.0.1:9090:9090 -p 127.0.0.1:9091:9091 openfire`\n\n\n#### Modify runtime configuration file\nTo close the avenue of potential attack, a runtime configuration file of Openfire can be modified.\n\nIn Openfire\u0027s installation directory, find the file `plugins/admin/webapp/WEB-INF/web.xml`. After creating a backup of this file, edit the original file.\n\nThe content of this file is XML. Find a `\u003cfilter\u003e` element, that contains the `\u003cfilter-name\u003eAuthCheck\u003c/filter-name\u003e` child element. Depending on your version of Openfire, it will look similar to this:\n\n```xml\n\u003cfilter\u003e\n    \u003cfilter-name\u003eAuthCheck\u003c/filter-name\u003e\n    \u003cfilter-class\u003eorg.jivesoftware.admin.AuthCheckFilter\u003c/filter-class\u003e\n    \u003cinit-param\u003e\n        \u003cparam-name\u003eexcludes\u003c/param-name\u003e\n        \u003cparam-value\u003e\n            login.jsp,index.jsp?logout=true,setup/index.jsp,setup/setup-*,.gif,.png,error-serverdown.jsp,loginToken.jsp\n        \u003c/param-value\u003e\n    \u003c/init-param\u003e\n\u003c/filter\u003e\n```\nThe value inside of the `param-value` element is a comma-separated list of values. From this list, remove all `*` (asterisk) characters.\n\nSave the file, and restart Openfire for the change to take effect.\n\nNote that no guarantees can be given that this runtime configuration change persists over time. Ensure to monitor the presence of the fix. It is recommended to upgrade to a safe version of Openfire as soon as possible.\n\nA side-effect of this change is that the Openfire web-based setup wizard will not function properly (functionality can be restored by reverting the change). This wizard is typically used only when initially installing Openfire.\n\n#### Bind admin console to loopback interface\nThe Openfire admin console is a web-based application. By default, the corresponding webserver (that is embedded in Openfire) binds to all network interfaces of the host that it is running on.\n\nThe admin console can be configured to bind to a specific network interface. This will prevent it from being accessed through other network interfaces. By configuring the admin console to bind to the local loopback interface, it is accessible only to users on the server itself. This reduces the avenue of attack.\n\nNote that several Openfire plugins expose part or all of their functionality through the admin console webserver. The REST API plugin, for example, serves its endpoints via this webserver. Availability of this functionality will be affected by binding the webserver to a specific network interface.\n\nTo bind the webserver of the Openfire admin console to a specific network interface, the \u0027openfire.xml\u0027 configuration file can be used.\n\nIn Openfire\u0027s installation directory, locate the file `conf/openfire.xml`. After creating a backup of this file, edit the original file.\n\nThe content of this file is XML. Find the `\u003cadminConsole\u003e` element that is a direct child element of the root `\u003cjive\u003e` element. Add a new element, named `\u003cinterface\u003e` as a child element of `\u003cadminConsole\u003e`. The value of the `\u003cinterface\u003e` element should be the name of the loopback interface or interface address. Setting value to `127.0.0.1` works on all tested environments (using values like  `lo` on most Linux systems or `lo0` on macOS will have the same effect).\n\nThe resulting fragment of the `openfire.xml` file will look similar to this:\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cjive\u003e\n  \u003cadminConsole\u003e\n      \u003cinterface\u003e127.0.0.1\u003c/interface\u003e\n      \u003cport\u003e9090\u003c/port\u003e\n      \u003csecurePort\u003e9091\u003c/securePort\u003e\n  \u003c/adminConsole\u003e\n\n  ...\n```\n\nSave the file, and restart Openfire for the change to take effect.\n\n#### Use AuthFilterSanitizer plugin\n\nThe Ignite Realtime community has made available a new plugin, called the AuthFilterSanitizer plugin. The plugin can be installed from the Openfire admin console, or can be downloaded from [the plugin\u0027s archive page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=authfiltersanitizer) on the IgniteRealtime.org community website.\n\nThis plugin periodically removes entries for Openfire\u0027s authentication filter that are susceptible to abuse, closing the avenue of potential attack.\n\nNote that this plugin might interfere with functionality that depends on the abuse-susceptible entries in the authentication filter that might be provided by plugins.\n\n### Credit\n\nThis issue was originally reported by Siebene@ who has our gratitude for the responsible and detailed disclosure of the issue! \n\nWe are grateful for the resources made available by Surevine ltd. They were instrumental in addressing the issue listed in this advisory.\n\n### References\n- [Ignite Realtime community site](https://www.igniterealtime.org/)\n- [Openfire releases download page](https://www.igniterealtime.org/downloads/#openfire)\n- [Openfire AuthFilter Sanitizer plugin releases download page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=authfiltersanitizer)\n- [Openfire HTTP File Upload plugin releases download page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=httpfileupload)\n- [Openfire Monitoring Service plugin releases download page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=monitoring)\n- [Openfire Random Avatar plugin releases download page](https://www.igniterealtime.org/projects/openfire/plugin-archive.jsp?plugin=randomavatar)\n- [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n- [Wikipedia: URL encoding, section \u0027Non-standard implementations\u0027](https://en.wikipedia.org/wiki/URL_encoding#Non-standard_implementations)\n- [Issue OF-2595 in Openfire\u0027s issue tracker](https://igniterealtime.atlassian.net/browse/OF-2595)\n- [Jetty CVE-2021-34429](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34429)",
  "id": "GHSA-gw42-f939-fhvm",
  "modified": "2025-10-22T19:20:57Z",
  "published": "2023-05-23T19:54:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32315"
    },
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/commit/2ac00a1ff42f5d3547ef58e21f8cdec992bfcf97"
    },
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/commit/71f3def2adeaac62729cf544b645c6819c3d9868"
    },
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/commit/a3b5ebd5032ff7be9d3ada5bf52bea2df96ec881"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/igniterealtime/Openfire"
    },
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/releases/tag/v4.6.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/releases/tag/v4.7.5"
    },
    {
      "type": "WEB",
      "url": "https://igniterealtime.atlassian.net/browse/OF-2595"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32315"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/173607/Openfire-Authentication-Bypass-Remote-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Administration Console authentication bypass in openfire xmppserver"
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-1829"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-11-15T23:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote authenticated users to execute arbitrary code by creating files that are outside the bounds of a share.",
  "id": "GHSA-gw44-f6p9-qmm4",
  "modified": "2022-05-17T05:45:34Z",
  "published": "2022-05-17T05:45:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1829"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT4435"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1024723"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22704"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-02T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.",
  "id": "GHSA-gw58-6f33-3447",
  "modified": "2022-05-24T19:12:53Z",
  "published": "2022-05-24T19:12:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22704"
    },
    {
      "type": "WEB",
      "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-5473"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-01T16:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary files via unspecified parameters to (1) upload/updateDriver or (2) upload/addDriver or to execute arbitrary code with SYSTEM privileges via unspecified parameters to (3) uploadCloning.html, (4) fileupload.html, (5) uploadFirmware.html, or (6) upload/driver.",
  "id": "GHSA-gw89-6xrw-4crf",
  "modified": "2022-05-17T02:41:54Z",
  "published": "2022-05-17T02:41:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5473"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/75912"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-296"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-297"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-298"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-299"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-300"
    },
    {
      "type": "WEB",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-15-301"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2007-4559"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-08-28T01:17:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.",
  "id": "GHSA-gw9q-c7gh-j9vm",
  "modified": "2025-01-17T15:32:30Z",
  "published": "2022-05-01T18:24:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4559"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=263261"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202309-06"
    },
    {
      "type": "WEB",
      "url": "http://mail.python.org/pipermail/python-dev/2007-August/074290.html"
    },
    {
      "type": "WEB",
      "url": "http://mail.python.org/pipermail/python-dev/2007-August/074292.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/26623"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/3022"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/bpg/terraform-provider-proxmox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.93.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T20:25:53Z",
    "nvd_published_at": "2026-02-04T21:16:01Z",
    "severity": "HIGH"
  },
  "details": "\u003e Note: It is uncertain whether this constitutes a vulnerability or should be filed as an issue instead.\n\n### Summary\n\nIn the SSH configuration documentation, the sudoer line that was suggested can be escalated to edit any files in the system.\n\n### Details\n\nThe following line were suggested for addition in the sudoers file:\n\n```bash\nterraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/*\n```\n\nBut this is highly insecure as  the folder can be escaped using `../` and any files can be edited on the system.\n\n### PoC\n\nUsing a `terraform` user with the previously mentioned line in the `/etc/sudoers` file, a `/etc/sudoers.d/sudo` file can be added using this command:\n\n`echo \"ALL=(ALL) NOPASSWD:ALL\" | tee /var/lib/vz/../../../etc/sudoers.d/sudo`\n\nThis grants access to the full root of the node.\n\n### Impact\n\nThis breaches the access limits of the Terraform user.\n\n### Suggested workaround\n\nUse a strict regex on the command to allow only the names that should be pushed by this user.\n\nExample for cloudinit yaml files:\n\n```bash\nterraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/snippets/[A-Za-z0-9-]*\\\\.yaml\n```",
  "id": "GHSA-gwch-7m8v-7544",
  "modified": "2026-02-04T21:58:25Z",
  "published": "2026-02-02T20:25:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bpg/terraform-provider-proxmox/security/advisories/GHSA-gwch-7m8v-7544"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bpg/terraform-provider-proxmox/commit/bd604c41a31e2a55dd6acc01b0608be3ea49c023"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bpg/terraform-provider-proxmox"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "terraform-provider-proxmox has insecure sudo recommendation in the documentation"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-76357"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T22:17:20Z",
    "severity": "HIGH"
  },
  "details": "In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Splunk SOAR (On-premises) security information (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/introduction-to-splunk-soar-on-premises/splunk-soar-on-premises-security-information) in the Splunk documentation.",
  "id": "GHSA-gwcv-h3gc-ghjv",
  "modified": "2026-08-20T00:35:02Z",
  "published": "2026-08-20T00:35:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76357"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0804"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}