Google Go 后置链接漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. Google Go suffers from a back-linking vulnerability that stems from improper authentication, where the container runtime may incorrectly handle certain file paths, allowing a...

USN-7046-1 bubblewrap, flatpak vulnerability

It was discovered that Flatpak incorrectly handled certain persisted directories. An attacker could possibly use this issue to read and write files in locations it would not normally have access to. A patch was also needed to Bubblewrap in order to avoid race conditions caused by this fix...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Flatpak and Bubblewrap vulnerability (USN-7046-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7046-1 advisory. It was discovered that Flatpak incorrectly handled certain persisted directories. An attacker could possibly use this issue to read and...

CVE-2024-47171 Agnai vulnerable to Relative Path Traversal in Image Upload

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended...

PT-2024-39516 · Logsign · Logsign Unified Secops Platform

Name of the Vulnerable Software and Affected Versions: Logsign Unified SecOps Platform affected versions not specified Description: This issue allows remote attackers to delete arbitrary files within sensitive directories on affected installations of Logsign Unified SecOps Platform. Authenticatio...

Remote Code Execution

Camaleon CMS is vulnerable to Remote Code Execution. The vulnerability is due to insufficient file handling in the MediaController's upload method, allowing authenticated users to write arbitrary files to any location on the server, depending on filesystem permissions. This can potentially lead t...

The vulnerability of the functional web frameworks WebMvc.fn and WebFlux.fn of the Spring Framework arises from incorrect path name restrictions for restricted directories. This allows attackers to gain access to any file in the file system.

The vulnerability of the functional web frameworks WebMvc.fn and WebFlux.fn of the Spring Framework is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to any file in t...

CVE-2024-6878 Directory Browsing in Eliz Software's Panel

Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations. This issue affects Panel: before v2.3.24...

The vulnerability of the generate_filename() function in the django.core.files.storage.Storage class of the Django web application framework allows a malicious actor to write arbitrary files.

The vulnerability of the generatefilename function in the django.core.files.storage.Storage class of the Django web application framework is related to an incorrect path name limitation for restricted directories. Exploiting this vulnerability could allow a malicious actor to write arbitrary file...

Eliz Panel 安全漏洞

Eliz Panel is a control panel from Eliz Corporation. A security vulnerability exists in Eliz Panel versions prior to 2.3.24 that stems from the presence of a vulnerability where a file or directory is accessible to an external party, which could allow an attacker to collect data from a public...

PT-2024-37922 · Eliz · Eliz Software Panel

Name of the Vulnerable Software and Affected Versions: Eliz Software Panel versions prior to 2.3.24 Description: The issue allows external parties to access files or directories, enabling the collection of data from common resource locations. Recommendations: For versions prior to 2.3.24, update ...

The vulnerability of the config_dirs function in the NGINX Agent demon and the NGINX Instance Manager automation platform allows a hacker to write or overwrite any files they desire.

The vulnerability of the configdirs function in the NGINX Agent demon and the NGINX Instance Manager platform relates to the ability to load arbitrary files beyond the expected directory path. Exploiting this vulnerability allows a malicious actor to write or rewrite arbitrary files remotely...

CLSA-2024-1726313380 flatpak: Fix of CVE-2024-42472

CVE-2024-42472: access to files outside sandbox for apps using persistent directories...

git: Recursive clones RCE

A vulnerability was found in Git. This vulnerability allows the malicious manipulation of repositories containing submodules, exploiting a bug that enables the writing of files into the .git/ directory instead of the submodule's intended worktree. This manipulation facilitates the execution of...

CVE-2024-7609

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Vidco Software VOC TESTER allows Path Traversal.This issue affects VOC TESTER: before 12.34.8...

GO-2024-3110 Can be confused to create empty files/directories on the host in github.com/opencontainers/runc

Can be confused to create empty files/directories on the host in github.com/opencontainers/runc...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...