Monthly
Path traversal in the web management interface of Tektronix 3 Series MDO oscilloscopes running firmware before 1.21.1 lets remote attackers read arbitrary files accessible to the web application by supplying insufficiently validated file paths. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), but unauthenticated exploitation depends on device configuration - deployments that require login to the web interface reduce the practical risk to authenticated users. Impact is limited to confidentiality (file reads, no write or code execution); no public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is bounded by these instruments typically residing on isolated lab networks rather than the internet.
Path traversal in the SCPI FILESystem command interface of Tektronix 3 Series MDO oscilloscopes running firmware before 1.21.1 allows authenticated remote attackers to read or modify arbitrary files on the device. The vulnerability arises from insufficient validation of file paths supplied to filesystem access commands and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exposure is typically limited because the SCPI interface is usually confined to lab or test networks rather than the public internet.
Unauthenticated path traversal in Countly Server before 24.05.50 and 25.03.44 lets remote attackers read arbitrary files that are readable by the server process, by abusing wildcard routes that serve public images and screenshots. The flaw affects deployments configured with the local filesystem backend of countlyFs (api/utils/countlyFs.js) - installs using the GridFS/database backend cannot be reached through these routes - and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), so no credentials, privileges, or user interaction are required. Impact is limited to file disclosure (no integrity or availability effect); vendor-released patches exist in 24.05.50 and 25.03.44, and no public exploit identified at time of analysis.
Arbitrary file and directory deletion in Countly Server (versions prior to 24.05.50 and 25.03.44) allows an authenticated user holding data-migration permission to pass a crafted exportid to the migration-deletion route and recursively remove any file or directory tree writable by the Countly server process, resulting in data loss and service disruption. The root issue is a path-traversal flaw (CWE-22) in plugins/data_migration/api/api.js in which the user-controlled exportid reaches clean_up_data in data_migration_helper.js without the sanitizeFilename-based containment checks introduced by the fix. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (base 8.1), confirming a network-reachable, low-complexity attack requiring an authenticated account (PR:L) with no user interaction, with high integrity and availability impact but no confidentiality exposure; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). Vendor fixes are available in 24.05.50 and 25.03.44.
Authenticated path traversal in Thermo Fisher Torrent Suite Software lets a user who already holds a valid low-privilege session on the Torrent Server web interface read arbitrary files that are accessible to the web service account. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), impact is confidentiality-only - no write, integrity, or code-execution effect - and the readable scope is bounded by the filesystem permissions of the web service account, so it cannot reach files that account cannot access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the authentication prerequisite confines realistic risk to insiders or attackers who have already obtained credentials; this is a moderate-priority information-disclosure issue rather than a critical emergency. CISA published an ICS medical advisory (ICSMA-26-288-01) covering this flaw.
Unauthenticated path traversal in the 10Web Booster WordPress plugin (versions up to and including 2.34.5) lets remote attackers create arbitrary directories outside the plugin's cache root, with 0777 permissions applied recursively, and plant a cached page inside them by feeding unsanitized GET parameter names and values into the cache path. The write primitive is strictly limited - the filename is hard-coded to source.html and the body is the server-rendered page buffer rather than attacker-supplied content, so no executable file can be planted and code execution is not achievable, with the realistic outcomes being cache poisoning and stray directory creation (published CVSS 7.5 with I:H; the independent assessment revises integrity impact to Low), and no public exploit identified at time of analysis.
Arbitrary file deletion in the Groundhogg CRM, Newsletters and Marketing Automation plugin for WordPress (all versions up to and including 4.9.3) lets an authenticated user who holds the plugin's import_contacts capability - granted by default to Groundhogg's custom Sales Representative role - name an arbitrary server-side path and have the plugin delete it, with a realistic escalation to remote code execution (for example by removing wp-config.php). The flaw is reachable through the contact-import (CSV), REST API, and webhook paths that call copy_file, and it received a CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no CISA KEV listing and no public exploit code identified at time of analysis. The practical risk is bounded by the authentication requirement and by the attacker's need to know or guess the absolute path of a valuable target, but the capability is assigned by default and no user interaction or non-default configuration is needed, making this a credible, actionable priority rather than an inflated high-CVSS issue.
Path traversal in WildFly's management take-snapshot operation lets an authenticated user holding only the Monitor RBAC role write a copy of the server configuration to an arbitrary filesystem location and then read it back, bypassing RBAC restrictions to disclose sensitive credentials. This is a credible, moderate-priority privilege-boundary bypass rather than a critical internet-facing threat, because exploitation requires an authenticated management session and a reachable management endpoint; no public exploit code has been identified at time of analysis and no vendor-released patch version is specified in the provided data.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition due to a path traversal flaw (CWE-22) that permits an attacker with low-privilege credentials to escape restricted directories and execute code over the network. The vulnerability carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N) and requires a valid SharePoint session, making it a credible priority for patching but not an immediate emergency according to current evidence. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Absolute plot names passed to MatplotlibDataset.save() in kedro-datasets 9.3.0 through 9.6.0 let an authenticated user with the ability to influence plot-name keys write files outside the configured dataset directory, overwriting or creating files anywhere the Kedro process has write access. The flaw is rooted in validate_sub_path(), which strips leading slashes before validation, combined with pathlib join semantics that discard the base path whenever the supplied sub-path is absolute (POSIX '/outside.png', Windows 'C:\\outside.png', or UNC '\\\\server\\share\\outside.png'). Integrity impact is rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N; CVSS 4.0 base 7.1), no public exploit code has been identified at time of analysis, and no CISA KEV entry exists; exploitability is gated by the attacker's ability to inject the plot-name keys (e.g., through untrusted input data or catalog configuration) and by the write permissions of the process running Kedro.
Path traversal in the web management interface of Tektronix 3 Series MDO oscilloscopes running firmware before 1.21.1 lets remote attackers read arbitrary files accessible to the web application by supplying insufficiently validated file paths. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), but unauthenticated exploitation depends on device configuration - deployments that require login to the web interface reduce the practical risk to authenticated users. Impact is limited to confidentiality (file reads, no write or code execution); no public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is bounded by these instruments typically residing on isolated lab networks rather than the internet.
Path traversal in the SCPI FILESystem command interface of Tektronix 3 Series MDO oscilloscopes running firmware before 1.21.1 allows authenticated remote attackers to read or modify arbitrary files on the device. The vulnerability arises from insufficient validation of file paths supplied to filesystem access commands and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and exposure is typically limited because the SCPI interface is usually confined to lab or test networks rather than the public internet.
Unauthenticated path traversal in Countly Server before 24.05.50 and 25.03.44 lets remote attackers read arbitrary files that are readable by the server process, by abusing wildcard routes that serve public images and screenshots. The flaw affects deployments configured with the local filesystem backend of countlyFs (api/utils/countlyFs.js) - installs using the GridFS/database backend cannot be reached through these routes - and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), so no credentials, privileges, or user interaction are required. Impact is limited to file disclosure (no integrity or availability effect); vendor-released patches exist in 24.05.50 and 25.03.44, and no public exploit identified at time of analysis.
Arbitrary file and directory deletion in Countly Server (versions prior to 24.05.50 and 25.03.44) allows an authenticated user holding data-migration permission to pass a crafted exportid to the migration-deletion route and recursively remove any file or directory tree writable by the Countly server process, resulting in data loss and service disruption. The root issue is a path-traversal flaw (CWE-22) in plugins/data_migration/api/api.js in which the user-controlled exportid reaches clean_up_data in data_migration_helper.js without the sanitizeFilename-based containment checks introduced by the fix. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (base 8.1), confirming a network-reachable, low-complexity attack requiring an authenticated account (PR:L) with no user interaction, with high integrity and availability impact but no confidentiality exposure; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). Vendor fixes are available in 24.05.50 and 25.03.44.
Authenticated path traversal in Thermo Fisher Torrent Suite Software lets a user who already holds a valid low-privilege session on the Torrent Server web interface read arbitrary files that are accessible to the web service account. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), impact is confidentiality-only - no write, integrity, or code-execution effect - and the readable scope is bounded by the filesystem permissions of the web service account, so it cannot reach files that account cannot access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the authentication prerequisite confines realistic risk to insiders or attackers who have already obtained credentials; this is a moderate-priority information-disclosure issue rather than a critical emergency. CISA published an ICS medical advisory (ICSMA-26-288-01) covering this flaw.
Unauthenticated path traversal in the 10Web Booster WordPress plugin (versions up to and including 2.34.5) lets remote attackers create arbitrary directories outside the plugin's cache root, with 0777 permissions applied recursively, and plant a cached page inside them by feeding unsanitized GET parameter names and values into the cache path. The write primitive is strictly limited - the filename is hard-coded to source.html and the body is the server-rendered page buffer rather than attacker-supplied content, so no executable file can be planted and code execution is not achievable, with the realistic outcomes being cache poisoning and stray directory creation (published CVSS 7.5 with I:H; the independent assessment revises integrity impact to Low), and no public exploit identified at time of analysis.
Arbitrary file deletion in the Groundhogg CRM, Newsletters and Marketing Automation plugin for WordPress (all versions up to and including 4.9.3) lets an authenticated user who holds the plugin's import_contacts capability - granted by default to Groundhogg's custom Sales Representative role - name an arbitrary server-side path and have the plugin delete it, with a realistic escalation to remote code execution (for example by removing wp-config.php). The flaw is reachable through the contact-import (CSV), REST API, and webhook paths that call copy_file, and it received a CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no CISA KEV listing and no public exploit code identified at time of analysis. The practical risk is bounded by the authentication requirement and by the attacker's need to know or guess the absolute path of a valuable target, but the capability is assigned by default and no user interaction or non-default configuration is needed, making this a credible, actionable priority rather than an inflated high-CVSS issue.
Path traversal in WildFly's management take-snapshot operation lets an authenticated user holding only the Monitor RBAC role write a copy of the server configuration to an arbitrary filesystem location and then read it back, bypassing RBAC restrictions to disclose sensitive credentials. This is a credible, moderate-priority privilege-boundary bypass rather than a critical internet-facing threat, because exploitation requires an authenticated management session and a reachable management endpoint; no public exploit code has been identified at time of analysis and no vendor-released patch version is specified in the provided data.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition due to a path traversal flaw (CWE-22) that permits an attacker with low-privilege credentials to escape restricted directories and execute code over the network. The vulnerability carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N) and requires a valid SharePoint session, making it a credible priority for patching but not an immediate emergency according to current evidence. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Absolute plot names passed to MatplotlibDataset.save() in kedro-datasets 9.3.0 through 9.6.0 let an authenticated user with the ability to influence plot-name keys write files outside the configured dataset directory, overwriting or creating files anywhere the Kedro process has write access. The flaw is rooted in validate_sub_path(), which strips leading slashes before validation, combined with pathlib join semantics that discard the base path whenever the supplied sub-path is absolute (POSIX '/outside.png', Windows 'C:\\outside.png', or UNC '\\\\server\\share\\outside.png'). Integrity impact is rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N; CVSS 4.0 base 7.1), no public exploit code has been identified at time of analysis, and no CISA KEV entry exists; exploitability is gated by the attacker's ability to inject the plot-name keys (e.g., through untrusted input data or catalog configuration) and by the write permissions of the process running Kedro.