1.
VULNERABILITY NAME
Directory Listing.

VULNERABILITY DETAILS
Many web applications use and manage files as part of their daily operation. Using input validation methods that have not been well designed or deployed, an aggressor could exploit the system in order to read or write files that are not intended to be accessible. In particular situations, it could be possible to execute arbitrary code or system commands. 

Traditionally, web servers and web applications implement authentication mechanisms to control access to files and resources. Web servers try to confine users' files inside a "root directory" or "web document root", which represents a physical directory on the file system. Users have to consider this directory as the base directory into the hierarchical structure of the web application.

Many web applications use server-side scripts to include different kinds of files. It is quite common to use this method to manage images, templates, load static texts, and so on. Unfortunately, these applications expose security vulnerabilities if input parameters (i.e., form parameters, cookie values) are not correctly validated.

In web servers and web applications, this kind of problem arises in path traversal/file include attacks. By exploiting this kind of vulnerability, an attacker is able to read directories or files which they normally couldn't read, access data outside the web document root, or include scripts and other kinds of files from external websites

REPRODUCTION CASE
1. Go to https://src.chromium.org/viewvc/
2. Click on Chrome folder

2.
VULNERABILITY NAME
Using Components With Known Vulnerabilities.

VULNERABILITY DETAILS
Components, such as libraries, frameworks, and other software modules, almost always run with full privileges. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities may undermine application defenses and enable a range of possible attacks and impacts.

REPRODUCTION CASE
1. Go to https://src.chromium.org/viewvc/
 

Deleted: Directory Listing.png 117 KB

	Directory Listing.png 117 KB View Download

Deleted: Using Components With Known Vulnerabilities.png 31.2 KB

	Using Components With Known Vulnerabilities.png 31.2 KB View Download