CVE-2025-37087

A vulnerability in the cmdb service of the HPE Performance Cluster Manager HPCM could allow an attacker to gain access to an arbitrary file on the server host...

CVE-2025-37087

CVE-2025-37087 affects HPE Performance Cluster Manager (HPCM) cmdb service. Multiple connected sources confirm a vulnerability that could allow an attacker to access an arbitrary file on the server host. The initial entry lists a high-severity CVSS 3.1 vector (9.8, NETWORK / LOW complexity / no u...

CVE-2025-37087

A vulnerability in the cmdb service of the HPE Performance Cluster Manager HPCM could allow an attacker to gain access to an arbitrary file on the server host...

CVE-2025-24908 Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal

Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. CWE-35 Description Hitachi...

CVE-2025-23010

An Improper Link Resolution Before File Access 'Link Following' vulnerability in SonicWall NetExtender Windows 32 and 64 bit client which allows an attacker to manipulate file paths...

CVE-2025-23010

An Improper Link Resolution Before File Access 'Link Following' vulnerability in SonicWall NetExtender Windows 32 and 64 bit client which allows an attacker to manipulate file paths...

CVE-2025-23010

An Improper Link Resolution Before File Access 'Link Following' vulnerability in SonicWall NetExtender Windows 32 and 64 bit client which allows an attacker to manipulate file paths...

CVE-2025-32395 Vite has an `server.fs.deny` bypass with an invalid `request-target`

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec RFC 9112 does not allow in request-target. Although an attacker can sen...

CVE-2025-25023

IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment...

CVE-2025-24232

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access arbitrary files...

CVE-2025-24232

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access arbitrary files...

CVE-2024-12905

An Improper Link Resolution Before File Access "Link Following" and Improper Limitation of a Pathname to a Restricted Directory "Path Traversal". This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intend...

CVE-2024-12905

An Improper Link Resolution Before File Access "Link Following" and Improper Limitation of a Pathname to a Restricted Directory "Path Traversal". This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intend...

Apache Commons VFS Path Traversal Vulnerability

Apache Commons VFS is a public virtual file system from the Apache USA Foundation. A path traversal vulnerability exists in Apache Commons VFS versions prior to 2.10.0, which stems from a program's failure to properly filter for special elements in a resource or file path. An attacker could explo...

CVE-2025-27837

CVE-2025-27837 affects Artifex Ghostscript prior to 10.05.0. A vulnerability in path handling allows access to arbitrary files via a truncated path containing invalid UTF-8 characters in base/gp_mswin.c and base/winrtsup.cpp. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a CRIT...

CVE-2025-27101

Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of t...

The vulnerability of AnyDesk’s remote access and management software lies in the improper definition of symbolic links before accessing files. This allows attackers to disclose sensitive information that should be protected.

The vulnerability of AnyDesk remote access and management software is related to the improper definition of symbolic links before accessing files. Exploiting this vulnerability can allow attackers to disclose protected information...

CVE-2025-27101

CVE-2025-27101 — Opal filesystem copy path traversal / access control issue : Opal (OBiBa) before version 5.1.1 exposes files from a user’s directory when copying any parent directory to a folder under /temp/. This flaw allows any user (including low-privilege DataShield users) to access files th...

CVE-2025-27397

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write...

CVE-2025-25267

A vulnerability has been identified in Tecnomatix Plant Simulation V2302 All versions V2302.0021, Tecnomatix Plant Simulation V2404 All versions V2404.0010. The affected application does not properly restrict the scope of files accessible to the simulation model. This could allow an unauthorized...