PT-2025-18882

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A regression in the removal of procfs host directories has been fixed in the Linux kernel. The issue is related to the scsi proc hostdir rm function, which decreases a reference counter...

Security update for runc

This update for runc fixes the following issues: CVE-2024-45310: Fixed unintentional creation of empty files/directories on host bsc1230092 Other fixes: Update to runc v1.2.6. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

User Profiles: the Achilles' Heel of Web Browsers

Web browsers provide the security foundation for our online experiences. Significant research has been done into the security of browsers themselves, but relatively little investigation has been done into how they interact with the operating system or the file system. In this work, we provide the...

CLSA-2025-1745426658 buildah: Fix of CVE-2024-9675

CVE-2024-9675: fix incorrect handling of paths in cache mounts that allows mounting of arbitrary directories in a container...

The vulnerability of the PHP library TCPDF, related to incorrect pathname restrictions for restricted access directories, allows attackers to gain unauthorized access to protected information.

The vulnerability of the PHP library TCPDF lies in the incorrect path limitation for the access to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2025-3577

UNSUPPORTED WHEN ASSIGNED A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00AAJC.16C0 could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTTP request to an affected...

Zyxel AMG1302-T10B 安全漏洞

The Zyxel AMG1302-T10B is an integrated wireless ADSL2+ router from Zyxel China. A security vulnerability exists in the Zyxel AMG1302-T10B version 2.00AAJC.16C0, which originates from a specially crafted HTTP request that results in path traversal and possible access to a restricted directory...

CVE-2025-3577: Improper Limitation of a Pathname to a Restricted Directory

UNSUPPORTED WHEN ASSIGNED A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00AAJC.16C0 could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTTP request to an affected...

PT-2025-17481 · Zyxel · Zyxel Amg1302-T10B

Name of the Vulnerable Software and Affected Versions: Zyxel AMG1302-T10B version 2.00AAJC.16C0 Description: A path traversal vulnerability in the web management interface could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTT...

PT-2025-17331 · Nessus · Nessus

Name of the Vulnerable Software and Affected Versions: Nessus versions prior to 10.8.4 Description: The issue is related to the installation of Nessus to a non-default location on a Windows host, where secure permissions for sub-directories were not enforced in versions prior to 10.8.4. This coul...

ABB CoreSense HM and CoreSense M10

SUMMARY An update is available that resolves vulnerability in the product versions listed as affected in this advisory. A path traversal vulnerability in these products can allow unauthenticated users to gain access to restricted directories. Exploiting this vulnerability can lead to complete...

BIT-DOLIBARR-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

PT-2025-14067 · Unknown · Cm Download Manager

Name of the Vulnerable Software and Affected Versions: CM Download Manager versions n/a through 2.9.6 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows unauthorized access. Recommendations: Update to a...

The vulnerability of the API component of FortiWeb’s web applications allows a hacker to execute arbitrary code or commands.

The vulnerability of the API component of FortiWeb web applications relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or commands remotely...

CVE-2025-2651 SourceCodester Online Eyewear Shop admin exposure of information through directory listing

A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /oews/admin/. The manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely. The explo...

CVE-2024-9597

A Path Traversal vulnerability exists in the /wipedatabase endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the key parameter, which is used to construct file paths. An attacker can exploit th...

PT-2025-12421

Name of the Vulnerable Software and Affected Versions Nessus Agent versions prior to 10.8.3 Description The issue arises when Nessus Agent is installed to a non-default location on a Windows host. In such cases, Nessus Agent did not enforce secure permissions for sub-directories, which could allo...

CVE-2024-9362

An unauthenticated directory traversal vulnerability exists in Polyaxon, affecting the latest version. This vulnerability allows an attacker to retrieve directory information and file contents from the server without proper authorization, leading to sensitive information disclosure. The issue...

CVE-2024-13126: Files or Directories Accessible to External Parties

The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files...

CVE-2024-13887: Authorization Bypass Through User-Controlled Key

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.14 via the 'ajaxlistingsubmitimageupload' function due to missing validation on a user controlled key. This makes...