Ensure That the Sticky Bit Is Set for Globally Writable Directories

The sticky bit of a common file is ignored by the kernel. The sticky bit shows up as the execute permission flag of a directory and is indicated with t. If the sticky bit set is for a directory, a user who is not root or the directory owner cannot delete files or directories in the directory,...

PT-2025-18901 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A issue in the Linux kernel has been identified, specifically in the ext4 file system, where possible corruption can occur when moving a directory. This happens because when renaming a...

The vulnerability of operating systems iOS, iPadOS, and macOS arises from incorrect restrictions on path names in restricted access directories, allowing attackers to gain unauthorized access to confidential data.

The vulnerability of iOS, iPadOS, and macOS operating systems is related to incorrect restrictions on path names in restricted access directories. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data...

PT-2025-18882 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A regression in the removal of procfs host directories has been fixed in the Linux kernel. The issue is related to the scsi proc hostdir rm function, which decreases a reference counte...

Security update for runc

This update for runc fixes the following issues: CVE-2024-45310: Fixed unintentional creation of empty files/directories on host bsc1230092 Other fixes: Update to runc v1.2.6. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

User Profiles: the Achilles' Heel of Web Browsers

Web browsers provide the security foundation for our online experiences. Significant research has been done into the security of browsers themselves, but relatively little investigation has been done into how they interact with the operating system or the file system. In this work, we provide the...

CLSA-2025-1745426658 buildah: Fix of CVE-2024-9675

CVE-2024-9675: fix incorrect handling of paths in cache mounts that allows mounting of arbitrary directories in a container...

The vulnerability of the PHP library TCPDF, related to incorrect pathname restrictions for restricted access directories, allows attackers to gain unauthorized access to protected information.

The vulnerability of the PHP library TCPDF lies in the incorrect path limitation for the access to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2025-3577

UNSUPPORTED WHEN ASSIGNED A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00AAJC.16C0 could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTTP request to an affected...

PT-2025-17481 · Zyxel · Zyxel Amg1302-T10B

Name of the Vulnerable Software and Affected Versions: Zyxel AMG1302-T10B version 2.00AAJC.16C0 Description: A path traversal vulnerability in the web management interface could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTT...

Zyxel AMG1302-T10B 安全漏洞

The Zyxel AMG1302-T10B is an integrated wireless ADSL2+ router from Zyxel China. A security vulnerability exists in the Zyxel AMG1302-T10B version 2.00AAJC.16C0, which originates from a specially crafted HTTP request that results in path traversal and possible access to a restricted directory...

PT-2025-17331 · Nessus · Nessus

Name of the Vulnerable Software and Affected Versions: Nessus versions prior to 10.8.4 Description: The issue is related to the installation of Nessus to a non-default location on a Windows host, where secure permissions for sub-directories were not enforced in versions prior to 10.8.4. This coul...

ABB CoreSense HM and CoreSense M10

SUMMARY An update is available that resolves vulnerability in the product versions listed as affected in this advisory. A path traversal vulnerability in these products can allow unauthenticated users to gain access to restricted directories. Exploiting this vulnerability can lead to complete...

BIT-DOLIBARR-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

PT-2025-14067 · Unknown · Cm Download Manager

Name of the Vulnerable Software and Affected Versions: CM Download Manager versions n/a through 2.9.6 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows unauthorized access. Recommendations: Update to a...

The vulnerability of the API component of FortiWeb’s web applications allows a hacker to execute arbitrary code or commands.

The vulnerability of the API component of FortiWeb web applications relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or commands remotely...

CVE-2025-2651 SourceCodester Online Eyewear Shop admin exposure of information through directory listing

A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /oews/admin/. The manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely. The explo...

CVE-2024-9597

A Path Traversal vulnerability exists in the /wipedatabase endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the key parameter, which is used to construct file paths. An attacker can exploit th...

CVE-2024-9362

An unauthenticated directory traversal vulnerability exists in Polyaxon, affecting the latest version. This vulnerability allows an attacker to retrieve directory information and file contents from the server without proper authorization, leading to sensitive information disclosure. The issue...

CVE-2025-2147

A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or directories accessible. It is possible to launch the attack...