Nicocha30

Single Content Sync allows exporting and importing content, referenced entities, and files between Drupal sites. The module fails to sufficiently validate file sources and destinations during content imports, leading to Path Traversal. This allows an attacker to write arbitrary files, disclose sensitive local files accessible to the web server, or trigger requests to internal or external resources. Depending on server configuration, this may result in remote code execution. Exploitation requires the *import single content* permission.

A path traversal flaw exists in the Unraid update request handling mechanism. This issue could allow for remote code execution. The vulnerability is related to the handling of update requests, potentially allowing an attacker to traverse file paths and execute arbitrary code on the system.

A path traversal authentication bypass issue exists in Unraid’s authentication request process. This allows remote attackers to bypass authentication on affected systems without needing to authenticate. The flaw is located in the `auth-request.php` file and is due to insufficient validation of a user-supplied path before it is used during authentication. An attacker can exploit this to bypass authentication on the system.

IceWarp Servers are experiencing a directory traversal issue that allows unauthorized disclosure of sensitive information. This issue is being actively exploited and does not require authentication. The exploitation is potentially linked to the FANCY BEAR threat actor. The vulnerability allows remote attackers to access sensitive data through a directory traversal mechanism.

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to update settings without authentication. An attacker can trigger sensitive functions within `util.php` by sending crafted requests to "/index.php".