6 reportsPriority Medium
Path traversal vulnerabilities in multiple products
Multiple products have been found to contain path traversal vulnerabilities that could allow attackers to execute code or gain elevated privileges, posing a risk to UK organisations using these systems.
First report Latest
What is going on
- A path traversal vulnerability in Fortinet FortiWeb was reported, allowing unauthenticated attackers to execute administrative commands via crafted HTTP or HTTPS requests.
- A separate path traversal vulnerability in RARLAB WinRAR was identified, enabling code execution in the context of the current user with reports of exploitation in the wild.
- Gogs was found to have a path traversal vulnerability affecting symbolic link handling, which could lead to code execution and has also been exploited in the wild.
- Cisco SD-WAN was reported to have a path traversal vulnerability that could allow authenticated local attackers to gain elevated privileges through improper access controls.
- Kentico Xperience was found to contain a path traversal vulnerability that could allow an authenticated user to upload arbitrary data, with reports of exploitation in the wild.
- A path traversal vulnerability in SimpleHelp was identified, allowing admin users to upload arbitrary files by exploiting a crafted zip file, with CISA reporting exploitation in the wild.
Reports in this story
Newest first. Each one is a separate event with its own sources and evidence.
- Priority MediumType VulnerabilityLead report
Fortinet FortiWeb Path Traversal Vulnerability
- Priority MediumType Vulnerability
RARLAB WinRAR Path Traversal Vulnerability
- Priority MediumType Vulnerability
Gogs Path Traversal Vulnerability
- Priority MediumType Vulnerability
Cisco SD-WAN Path Traversal Vulnerability
- Priority MediumType Vulnerability
Kentico Xperience Path Traversal Vulnerability
- Priority MediumType Vulnerability
SimpleHelp Path Traversal Vulnerability