422 matches found
ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths
A flaw was found in Ghostscript. When the gpvalidatepathlen function validates a path, it distinguishes between absolute and relative paths. In the case of relative paths, it will check the path with and without the current-directory-prefix "foo" and "./foo". This does not take into account paths...
AlmaLinux 9 : ghostscript (ALSA-2024:6197)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6197 advisory. ghostscript: format string injection leads to shell command execution SAFER bypass CVE-2024-29510 ghostscript: path traversal and command execution due to...
ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths
A flaw was found in Ghostscript. When the gpvalidatepathlen function validates a path, it distinguishes between absolute and relative paths. In the case of relative paths, it will check the path with and without the current-directory-prefix "foo" and "./foo". This does not take into account paths...
Oracle Linux 9 : ghostscript (ELSA-2024-6197)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6197 advisory. - RHEL-44759 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths - RHEL-44745 CVE-2024-338...
GO-2022-0395 GitHub CLI can execute a git binary from the current directory in github.com/cli/cli
GitHub CLI can execute a git binary from the current directory in github.com/cli/cli...
Important: gtk3
Issue Overview: gtk3: gtk2: Library injection from CWD CVE-2024-6655 Affected Packages: gtk3 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update gtk3 or yum...
OESA-2024-1892 gtk3 security update
GTK+ is an object-oriented widget toolkit written in the programming language C; it has a C-based object-oriented architecture that allows for maximum flexibility. The GTK+ library contains a set of graphical control elements widgetsfor creating graphical user interfaces. This package contains...
OESA-2024-1886 gtk2 security update
GTK+ is a library for creating graphical user interfaces. The library is created in C programming language. The GTK+ is also called the GIMP Toolkit. Originally, the library was created while developing the GIMP image manipulation program. Security Fixes: A flaw was found in the GTK library. Unde...
AZL-43377 CVE-2024-6655 affecting package gtk3 for versions less than 3.24.28-10
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...
AZL-43381 CVE-2024-6655 affecting package gtk2 for versions less than 2.24.32-12
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...
AZL-43384 CVE-2024-6655 affecting package gtk2 for versions less than 2.24.32-12
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...
AZL-43387 CVE-2024-6655 affecting package gtk3 for versions less than 3.24.28-10
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...
DEBIAN-CVE-2024-6655
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...
USN-6899-1 gtk+2.0, gtk+3.0 vulnerability
It was discovered that GTK would attempt to load modules from the current directory, contrary to expectations. If users started GTK applications from shared directories, a local attacker could use this issue to execute arbitrary code, and possibly escalate privileges...
UBUNTU-CVE-2024-6655
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...
Artifex Ghostscript Security Vulnerability
Artifex Ghostscript is a set of free software compiled by Artifex, Inc. based on Adobe, PostScript, and the Page Description Language for Portable Document Format PDL. A security vulnerability exists in Artifex Ghostscript versions prior to 10.03.1, which can be exploited to traverse paths to...
PT-2024-1636 · Unknown · Pixee Java Code Security Toolkit
Name of the Vulnerable Software and Affected Versions: Pixee Java Code Security Toolkit versions =1.1.1 Description: The issue is related to a partial-path traversal bypass vulnerability in the ZipSecurityisBelowCurrentDirectory function. This vulnerability allows attackers to "escape" into sibli...
PT-2024-19413 · Unknown · Anything-Llm
Name of the Vulnerable Software and Affected Versions: AnythingLLM versions prior to commit 08d33cfd8 Description: AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting. In versions prior to commit...
CVE-2023-47454
An Untrusted search path vulnerability in NetEase CloudMusic 2.10.4 for Windows allows local users to gain escalated privileges through the urlmon.dll file in the current working directory...