Aspnet
Monthly
Path traversal in PMWeb 7.x, 8.x, and 2025.x lets unauthenticated remote attackers read files from the server filesystem by supplying traversal sequences in the FullFileName or FileName argument of downloader.aspx. The issue is rated CVSS v4.0 6.9 and independently assessed as CVSS v3.1 6.9 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), i.e. a network-reachable, no-authentication, read-only file disclosure with high confidentiality impact and no integrity or availability impact. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV), and the vendor did not respond to the disclosure; practical risk is tempered by PMWeb's niche deployment in construction and capital-program organizations and the frequent internal or access-restricted placement of those instances.
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path traversal in PMWeb 7.x, 8.x, and 2025.x lets unauthenticated remote attackers read files from the server filesystem by supplying traversal sequences in the FullFileName or FileName argument of downloader.aspx. The issue is rated CVSS v4.0 6.9 and independently assessed as CVSS v3.1 6.9 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), i.e. a network-reachable, no-authentication, read-only file disclosure with high confidentiality impact and no integrity or availability impact. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV), and the vendor did not respond to the disclosure; practical risk is tempered by PMWeb's niche deployment in construction and capital-program organizations and the frequent internal or access-restricted placement of those instances.
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.