4019 matches found
The vulnerability of the library for processing HTTP requests in the HTTP_Request2 VPN-client Tunnelblick, related to the disclosure of information through test directories, allows a perpetrator to carry out XSS attacks and elevate their privileges to the root level.
The vulnerability of the library for processing HTTP requests in the HTTPRequest2 VPN-client Tunnelblick component is related to the disclosure of information through the tests/network/getparameters.php and tests/network/postparameters.php directories. Exploiting this vulnerability allows a remot...
The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain access to read, modify, or delete data, or to cause a service failure.
The vulnerability of the Core component of the Oracle VM VirtualBox software lies in an improper access to common directories due to incorrectly implemented authentication procedures. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete access to data, or cause...
FreeScout Security Bypass Vulnerability (CNVD-2025-20798)
FreeScout is an ultra-lightweight free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout. FreeScout suffers from a security bypass vulnerability that is caused by improper input validation of the laravel translation manager package. An attacker can exploit the...
CVE-2025-48950
MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as /bin,/usr/bin, etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directori...
CVE-2025-48950
MaxKB (open-source AI assistant) prior to version 1.10.8-lts is affected by a sandbox bypass in the Python function library: the sandbox only enforces execution permissions for binaries in common directories (e.g., /bin, /usr/bin), allowing attackers to exploit files with execution permission in ...
MaxKB 安全漏洞
MaxKB is a 1Panel-dev open source open source knowledge base question and answer system based on a large language model and RAG. A security vulnerability exists in versions prior to MaxKB 1.10.8-lts, which stems from a sandbox that restricts execution permissions to binary files in common...
PT-2025-23652 · Maxkb · Maxkb
Name of the Vulnerable Software and Affected Versions: MaxKB versions prior to 1.10.8-lts Description: The issue allows attackers to exploit certain files with execution permissions in non-blacklisted directories to carry out attacks, as the Sandbox only restricts the execution permissions of...
CVE-2025-48387
A flaw was found in tar-fs. This vulnerability allows files to be written outside the intended extraction directory via specially crafted tar archives. The issue arises from insufficient path validation during tarball extraction, potentially enabling path traversal attacks that can overwrite...
CVE-2024-29188
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire directory tree during installation or...
CVE-2024-31226
Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the user's computer. This...
CVE-2023-23625
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout paramete...
CVE-2023-6505
The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files...
CVE-2023-6592
The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files...
CVE-2023-0156
The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...
CVE-2023-23631
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an...
PT-2025-22760 · Unknown · Belingo Belingogeo
Name of the Vulnerable Software and Affected Versions: Belingo belingoGeo versions 1.12.0 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in Belingo belingoGeo...
PT-2025-22671 · Unknown · Quantumcloud Kbx Pro Ultimate
Name of the Vulnerable Software and Affected Versions: quantumcloud KBx Pro Ultimate versions n/a through 7.9.8 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in quantumcloud KBx P...
CVE-2022-40309
Users with write permissions to a repository can delete arbitrary directories...
CVE-2022-20219
In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencrypted due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is no...