Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-26032 State: PUBLISHED Published: 2020-12-28T07:56:54 Last Updated: 2024-08-04T15:49:06.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in a way that renders the result of a test request to the User. An attacker can use this to request any URL via a GET request from the network interface of the server. This may lead to disclosure of information from intranet systems. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-15
CVE ID: CVE-2020-26033 State: PUBLISHED Published: 2020-12-28T07:56:43 Last Updated: 2024-08-04T15:49:06.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF token check. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-17
CVE ID: CVE-2020-26034 State: PUBLISHED Published: 2020-12-28T07:56:33 Last Updated: 2024-08-04T15:49:06.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a way that would enable an anonymous user to guess valid user email addresses. The application responds differently depending on whether the input supplied was recognized as associated with a valid user. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-14
CVE ID: CVE-2020-26035 State: PUBLISHED Published: 2020-12-28T07:56:18 Last Updated: 2024-08-04T15:49:06.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/news/security-advisory-zaa-2020-21
CVE ID: CVE-2020-26037 State: PUBLISHED Published: 2023-08-16T00:00:00 Last Updated: 2024-10-08T19:29:01.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Server functionalty in Even Balance Punkbuster version 1.902 before 1.905 allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://even.com - http://punkbuster.com - https://medium.com/%40prizmant/hacking-punkbuster-e22e6cf2f36e
CVE ID: CVE-2020-26041 State: PUBLISHED Published: 2020-09-29T13:40:19 Last Updated: 2024-08-04T15:49:06.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kr0za/bugs/blob/master/hoosk.md#0x01-install-rce
CVE ID: CVE-2020-26042 State: PUBLISHED Published: 2020-09-29T13:43:20 Last Updated: 2024-08-04T15:49:07.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kr0za/bugs/blob/master/hoosk.md#0x02-install-sqli
CVE ID: CVE-2020-26043 State: PUBLISHED Published: 2020-09-29T13:45:37 Last Updated: 2024-08-04T15:49:06.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kr0za/bugs/blob/master/hoosk.md#0x03-install-xss
CVE ID: CVE-2020-26045 State: PUBLISHED Published: 2021-01-05T14:16:59 Last Updated: 2024-08-04T15:49:06.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Additional Analyst Notes: - CVE Program Container: References: - https://getfuelcms.com - https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.11 - https://github.com/daylightstudio/FUEL-CMS/issues/575
CVE ID: CVE-2020-26046 State: PUBLISHED Published: 2021-01-05T14:17:17 Last Updated: 2024-08-04T15:49:06.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors. Additional Analyst Notes: - CVE Program Container: References: - https://getfuelcms.com - https://github.com/daylightstudio/FUEL-CMS/issues/574
CVE ID: CVE-2020-26048 State: PUBLISHED Published: 2020-10-05T14:27:01 Last Updated: 2024-08-04T15:49:06.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: The file manager option in CuppaCMS before 2019-11-12 allows an authenticated attacker to upload a malicious file within an image extension and through a custom request using the rename function provided by the file manager is able to modify the image extension into PHP resulting in remote arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CuppaCMS/CuppaCMS/issues/7
CVE ID: CVE-2020-26049 State: PUBLISHED Published: 2020-12-21T14:51:01 Last Updated: 2024-08-04T15:49:06.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://hardik-solanki.medium.com/html-injection-stored-which-ultimately-resulted-into-a-cve-2020-26049-61c1a47dc2e8
CVE ID: CVE-2020-26050 State: PUBLISHED Published: 2021-01-12T03:00:08 Last Updated: 2024-08-04T15:49:07.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted openssl configuration file. This issue is similar to CVE-2019-12572. Additional Analyst Notes: - CVE Program Container: References: - https://vimeo.com/459654003 - https://thebinary0x1.medium.com/cve-2020-26050-safervpn-for-windows-local-privilege-escalation-da069bb1373c - https://www.safervpn.com/blog/updates-to-the-safervpn-windows-application/
CVE ID: CVE-2020-26051 State: PUBLISHED Published: 2021-02-08T13:31:12 Last Updated: 2024-08-04T15:49:07.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: College Management System Php 1.0 suffers from SQL injection vulnerabilities in the index.php page from POST parameters 'unametxt' and 'pwdtxt', which are not filtered before passing a SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48593
CVE ID: CVE-2020-26052 State: PUBLISHED Published: 2021-02-08T13:31:30 Last Updated: 2024-08-04T15:49:07.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Marriage Registration System 1.0 is affected by stored cross-site scripting (XSS) vulnerabilities in multiple parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48522
CVE ID: CVE-2020-26053 State: REJECTED Published: 2020-09-29T13:28:04 Last Updated: 2020-10-01T19:41:29 Description: No description available.
CVE ID: CVE-2020-26061 State: PUBLISHED Published: 2020-10-05T13:43:20 Last Updated: 2024-08-04T15:49:06.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClickStudios Passwordstate Password Reset Portal prior to build 8501 is affected by an authentication bypass vulnerability. The ResetPassword function does not validate whether the user has successfully authenticated using security questions. An unauthenticated, remote attacker can send a crafted HTTP request to the /account/ResetPassword page to set a new password for any registered user. Additional Analyst Notes: - CVE Program Container: References: - https://www.clickstudios.com.au/passwordstate-changelog.aspx - https://gi
Notes: - CVE Program Container: References: - https://www.clickstudios.com.au/passwordstate-changelog.aspx - https://github.com/missing0x00/CVE-2020-26061
CVE ID: CVE-2020-26062 State: PUBLISHED Published: 2024-11-18T16:06:00.592Z Last Updated: 2024-11-18T18:46:04.617Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/RL:X/RC:X/E:X) Vendors: Cisco Products: Cisco Unified Computing System (Managed) Problem Types: CWE-203 Description: A vulnerability in Cisco&nbsp;Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerable application. The vulnerability is due to differences in authentication responses sent back from the application as part of an authentication attempt. An attacker could exploit this vulnerability by sending authentication requests to t
part of an authentication attempt. An attacker could exploit this vulnerability by sending authentication requests to the affected application. A successful exploit could allow the attacker to confirm the names of administrative user accounts for use in further attacks.There are no workarounds that address this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-enum-CyheP3B7 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vsoln-arbfile-gtsEYxns - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa
cisco-sa-vsoln-arbfile-gtsEYxns - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-xss-zLW9tD3 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx3-vrZbOqqD - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-zWkppJxL
CVE ID: CVE-2020-26063 State: PUBLISHED Published: 2024-11-18T16:05:53.165Z Last Updated: 2024-11-18T19:49:33.809Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/RL:X/RC:X/E:X) Vendors: Cisco Products: Cisco Unified Computing System (Managed) Problem Types: CWE-269 Description: A vulnerability in the API endpoints of Cisco&nbsp;Integrated Management Controller could allow an authenticated, remote attacker to bypass authorization and take actions on a vulnerable system without authorization. The vulnerability is due to improper authorization checks on API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An explo
n API endpoints. An attacker could exploit this vulnerability by sending malicious requests to an API endpoint. An exploit could allow the attacker to download files from or modify limited configuration options on the affected system.There are no workarounds that address this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-zWkppJxL - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vsoln-arbfile-gtsEYxns - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-xss-zLW9tD3 - https://se
ps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-xss-zLW9tD3 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx3-vrZbOqqD
CVE ID: CVE-2020-26064 State: PUBLISHED Published: 2023-08-04T20:52:31.662Z Last Updated: 2024-08-04T15:49:06.698Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Cisco Products: Cisco SD-WAN vManage Problem Types: CWE-611 Description: A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A su
attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files within the affected application. Additional Analyst Notes: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx2-KpFVSUc
CVE ID: CVE-2020-26065 State: PUBLISHED Published: 2023-08-04T20:51:55.199Z Last Updated: 2024-10-09T18:44:33.408Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Cisco Products: Cisco SD-WAN vManage Problem Types: CWE-22 Description: A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequen
er could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanpt2-FqLuefsS
CVE ID: CVE-2020-26066 State: PUBLISHED Published: 2024-11-18T16:23:47.442Z Last Updated: 2024-11-18T17:20:31.871Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:X/RL:X/RC:X) Vendors: Cisco Products: Cisco Catalyst SD-WAN Manager Problem Types: CWE-611 Description: A vulnerability in the web UI of Cisco&nbsp;SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file
rsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files within the affected application.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx3-vrZbOqqD
CVE ID: CVE-2020-26067 State: PUBLISHED Published: 2024-11-18T16:10:24.951Z Last Updated: 2024-11-26T14:41:03.582Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/RL:X/RC:X/E:X) Vendors: Cisco Products: Cisco Webex Teams Problem Types: CWE-80 Description: A vulnerability in the web-based interface of Cisco&nbsp;Webex Teams could allow an authenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of usernames. An attacker could exploit this vulnerability by creating an account that contains malicious HTML or script content and joining a space using the malicious account name. A successful exploit could allow
malicious HTML or script content and joining a space using the malicious account name. A successful exploit could allow the attacker to conduct cross-site scripting attacks and potentially gain access to sensitive browser-based information.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-xss-zLW9tD3
CVE ID: CVE-2020-26068 State: PUBLISHED Published: 2020-11-18T17:40:14.843607Z Last Updated: 2024-11-13T17:40:15.999Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco TelePresence Endpoint Software (TC/CE) Problem Types: CWE-639 Description: A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An attacker could exploit this vulnerability by using the xAPI service to generate a specific token. A successful exploit could allow the attacker
this vulnerability by using the xAPI service to generate a specific token. A successful exploit could allow the attacker to use the generated token to enable experimental features on the device that should not be available to users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tp-uathracc-jWNESUfM
CVE ID: CVE-2020-26070 State: PUBLISHED Published: 2020-11-12T02:05:13.841123Z Last Updated: 2024-11-13T17:40:55.842Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco IOS XR Software Problem Types: CWE-404 Description: A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper resource allocation when an affected device processes network traffic in software switching mode (punted). An attacker could exploit this
on when an affected device processes network traffic in software switching mode (punted). An attacker could exploit this vulnerability by sending specific streams of Layer 2 or Layer 3 protocol data units (PDUs) to an affected device. A successful exploit could cause the affected device to run out of buffer resources, which could make the device unable to process or forward traffic, resulting in a DoS condition. The device would need to be restarted to regain functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cp-dos-ej8VB9QY
CVE ID: CVE-2020-26071 State: PUBLISHED Published: 2024-11-18T16:05:35.221Z Last Updated: 2024-11-18T16:23:51.429Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H/RL:X/RC:X/E:X) Vendors: Cisco Products: Cisco Catalyst SD-WAN Manager, Cisco SD-WAN vContainer, Cisco SD-WAN vEdge Cloud, Cisco SD-WAN vEdge Router Problem Types: CWE-22 Description: A vulnerability in the CLI of Cisco&nbsp;SD-WAN Software could allow an authenticated, local attacker to create or overwrite arbitrary files on an affected device, which could result in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation for specific commands. An attacker could exploit th
condition. The vulnerability is due to insufficient input validation for specific commands. An attacker could exploit this vulnerability by including crafted arguments to those specific commands. A successful exploit could allow the attacker to create or overwrite arbitrary files on the affected device, which could result in a DoS condition.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vsoln-arbfile-gtsEYxns
CVE ID: CVE-2020-26072 State: PUBLISHED Published: 2020-11-18T17:40:19.577785Z Last Updated: 2024-11-13T17:40:04.025Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Cisco Products: Cisco IoT Field Network Director (IoT-FND) Problem Types: CWE-284 Description: A vulnerability in the SOAP API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to access and modify information on devices that belong to a different domain. The vulnerability is due to insufficient authorization in the SOAP API. An attacker could exploit this vulnerability by sending SOAP API requests to affected devices for devices that are outside their authori
d exploit this vulnerability by sending SOAP API requests to affected devices for devices that are outside their authorized domain. A successful exploit could allow the attacker to access and modify information on devices that belong to a different domain. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-AUTH-vEypBmmR
CVE ID: CVE-2020-26073 State: PUBLISHED Published: 2024-11-18T15:57:25.059Z Last Updated: 2024-11-18T16:52:48.583Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/RL:X/RC:X/E:X) Vendors: Cisco Products: Cisco Catalyst SD-WAN Manager Problem Types: CWE-35 Description: A vulnerability in the application data endpoints of Cisco&nbsp;SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to application programmatic interfaces (APIs). An attacker could exploit this vulnerability by sending malicious requests to a
lication programmatic interfaces (APIs). An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and gain access to sensitive information including credentials or user tokens.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-traversal-hQh24tmk - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurit
SecurityAdvisory/cisco-sa-vman-traversal-hQh24tmk - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-dos-7uZWwSEy - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-escalation-Jhqs5Skf
CVE ID: CVE-2020-26074 State: PUBLISHED Published: 2024-11-18T15:56:13.890Z Last Updated: 2024-11-18T16:52:24.869Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/RL:X/RC:X/E:X) Vendors: Cisco Products: Cisco Catalyst SD-WAN Manager Problem Types: CWE-250 Description: A vulnerability in system file transfer functions of Cisco&nbsp;SD-WAN vManage Software could allow an authenticated, local attacker to gain escalated privileges on the underlying operating system. The vulnerability is due to improper validation of path input to the system file transfer functions. An attacker could exploit this vulnerability by sending requests that contain specially crafted path variables