CVE-2025-43298

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privileges...

CVE-2025-43190

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data...

CVE-2025-43190

A parsing issue in the handling of directory paths exists across several Apple operating systems, including iOS 26 , iPadOS 26 , macOS Sequoia 15.7 , macOS Sonoma 14.8 , macOS Tahoe 26 , visionOS 26 , and watchOS 26 . The root cause is a lack of sufficient path validation, which could allow an ap...

CVE-2025-43190

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sonoma 14.8, macOS Sequoia 15.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. An app may be able to access sensitive user data...

CVE-2025-43314

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access sensitive user data...

PT-2025-37807

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Sequoia 15.7 macOS versions prior to Sonoma 14.8 macOS versions prior to Tahoe 26 Description: A parsing issue in the handling of directory paths exists. Improved path validation addresses this issue. An application ma...

Several Apple products have security vulnerabilities

Apple iOS and others are products of Apple Inc. Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for iPad tablets.Apple visionOS is an operating system for AR glasses. A security vulnerability exists in several Apple products that stems from improp...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

Arbitrary Command Injection

Overview codeceptjs is a Supercharged End 2 End Testing Framework for NodeJS Affected versions of this package are vulnerable to Arbitrary Command Injection via the emptyFolder function. An attacker can execute arbitrary system commands by supplying crafted input to the directoryPath parameter...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

CVE-2025-57285

The codeceptjs testing framework (versions 3.5.0 through 3.7.5-beta.18 ) is vulnerable to a command injection vulnerability in the emptyFolder function located in lib/utils.js. The root cause is that the execSync command directly concatenates the user-controlled directoryPath parameter without pr...

CVE-2025-57285

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary commands...

TrueConf Server Path Traversal Unauthorized Access

The vulnerability of the TrueConf Server software is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Splunk Web DoS

The vulnerability of the Splunk Enterprise operational analytics web platform’s component is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

Splunk Web DoS

The vulnerability of the Splunk Enterprise operational analytics web platform’s Splunk component is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

ROS-20250827-03

A vulnerability in the resolveFile method of the Apache Commons VFS Virtual File System unified API for accessing different file systems is due to errors in the relative path handling of the directory when processing the relative path of the directory. Virtual File System method is related to...

ROS-20250825-05

A vulnerability in the Ruby Sinatra web application development framework is related to a flaw in limiting the name of the of the directory path. Exploitation of the vulnerability allows an attacker acting remotely to gain access to sensitive data...

CVE-2025-54927

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system...

CVE-2025-50817

A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker...