135135 matches found
open-iscsi: open-iscsi: Privilege Escalation via Path Traversal
A flaw was found in open-iscsi. This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle MITM attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records. This...
CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization
An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...
CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization
An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...
CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization
An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...
CVE-2026-47862
Spring Integration's ZipTransformer component is vulnerable to a path traversal issue when using the default ZipResultType.FILE result type. An attacker who can set the file_name message header on a message reaching the transformer can cause the resulting .zip archive to be written to an arbitrar...
WSOB
😭 WSOB CVE-2022-29464 😭 WSOB é uma ferramenta Python criada para explorar a nova vulnerabilidade no WSO2 atribuída como CVE-2022-29464. Detalhes do CVE-2022-29464: Certos produtos WSO2 permitem upload de arquivos irrestrito com consequente execução remota de código. O atacante deve usar um endpoi...
CVE-2026-75333
yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...
CVE-2024-45241
CVE-2024-45241 Traversal de Caminho no CryWolf da CentralSquare Uma vulnerabilidade de traversal de caminho no aplicativo CryWolf Gerenciamento de Alarmes Falsos permite que atacantes não autenticados leiam arquivos fora do diretório web de trabalho, levando à divulgação de informações...
Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities
Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-15392 DESCRIPTION: DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The completetablename method builds the...
CVE-2026-61792
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...
EUVD-2026-66716
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...
CVE-2026-61792 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...
CVE-2026-61792
Weblate , a web-based continuous localization platform, is affected by a path traversal vulnerability in its App store metadata download feature (versions prior to 2026.7 ). Attacker-influenced paths are resolved without adequate confinement to the repository, allowing a user with project-adminis...
CVE-2026-61792
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...
CVE-2026-61792 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...
CVE-2026-61792 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...
CVE-2026-63179
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...
CVE-2026-36851
Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...
EUVD-2026-66654
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...
