3462 matches found
CLSA-2025-1754940505 git: Fix of CVE-2025-27613
CVE-2025-27613: fix issue where untrusted repositories could create and truncate files, with the fix implemented in versions 2.43.7 and later...
CVE-2025-54417
Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-23209: "Craft CMS has a potential RCE with a compromised security key". To exploit this vulnerability, the project must meet these...
CVE-2012-10044
MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking fileputcontents on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending...
WordPress HT Mega plugin path traversal vulnerability
WordPress HT Mega plugin is an Elementor page builder plugin designed for WordPress, offering over 100 custom widgets, 360+ preset modules, and a variety of templates for blogs, sliders, collapsible menus, and other page elements. A path traversal vulnerability exists in the WordPress HT Mega...
CVE-2012-10044
MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking fileputcontents on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending...
CVE-2012-10044 MobileCartly 1.0 savepage.php Arbitrary File Creation
MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking fileputcontents on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending...
CVE-2012-10044
MobileCartly 1.0 is affected by an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication/authorization before invoking file_put_contents() on attacker-controlled input, allowing an unauthenticated attacker to send crafted HTTP GET reques...
CVE-2012-10044 MobileCartly 1.0 savepage.php Arbitrary File Creation
MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking fileputcontents on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending...
CLSA-2025-1754648405 Fix CVE(s): CVE-2025-27613, CVE-2025-27614, CVE-2025-46835
SECURITY UPDATE: potential file creation/truncation when cloning untrusted repository in gitk - debian/patches/CVE-2025-27613CVE-2025-27614CVE-2025-46835.patch: improve dark mode support, remove hard-coded colors in ttext calls and use colors from the theme for text widgets via Text.Background an...
PT-2025-32397 · Unknown · Mobilecartly
Name of the Vulnerable Software and Affected Versions: MobileCartly version 1.0 Description: MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application does not perform authentication or authorization checks before using the file put...
MobileCartly ćźć šæŒæŽ
MobileCartly is an m-commerce shopping cart system from MobileCartly, Inc. A security vulnerability exists in MobileCartly version 1.0, which stems from a savepage.php script that does not perform authentication or authorization checks, and could lead to arbitrary file creation and remote code...
CVE-2025-54135
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file...
CLSA-2025-1754413251 git: Fix of 2 CVEs
CVE-2025-27614: fix a vulnerability in Gitk that allowed arbitrary script execution via specially crafted filenames in a repository - CVE-2025-27614: fix a vulnerability in Gitk that allowed arbitrary file creation/truncation - CVE-2025-46835: fix a vulnerability in Git GUI where editing files in...
CLSA-2025-1754413156 git: Fix of 2 CVEs
CVE-2025-27614: fix a vulnerability in Gitk that allowed arbitrary script execution via specially crafted filenames in a repository - CVE-2025-27614: fix a vulnerability in Gitk that allowed arbitrary file creation/truncation - CVE-2025-46835: fix a vulnerability in Git GUI where editing files in...
CVE-2025-54135
Cursor before v1.3.9 allows prompt-injection via MCP MCP server data to auto-run and write to ~/.cursor/mcp.json, enabling RCE when processing external content. Affected: Cursor AI code editor (Cursor) in-workspace file writes without user approval; dotfiles require approval but new dotfiles do n...
The vulnerability in the Git GUI graphical user interface relates to the insertion or modification of arguments, allowing attackers to create or overwrite arbitrary files.
The vulnerability of the Git GUI graphical user interface is related to the implementation or modification of arguments. Exploiting this vulnerability allows an attacker to create or overwrite arbitrary files...
The vulnerabilities of the Support-per-file encoding() and Show origin of this line() functions in the Gitk browser allow attackers to gain unauthorized access to create and delete user files.
The vulnerability of the Support per-file encoding and Show origin of this line functions in the Gitk browser exists because measures to eliminate special elements are not taken. Exploiting this vulnerability can allow an intruder to gain unauthorized access to create and delete user files...
Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2025-1108)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1108 advisory. When a user clones an untrusted repository and runs Gitk without additional command arguments, any writable file can be created and truncated. The option Support per-file encoding must have be...
CVE-2025-53081
An 'Arbitrary File Creation' in Samsung DMSData Management Server allows attackers to create arbitrary files in unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses...
Apache Jena Fuseki vulnerable to path traversal
Overview Jena Fuseki provided by The Apache Software Foundation contains the following vulnerability. Path traversal CWE-22 - CVE-2025-49656 Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to the developer and IPA. After the coordination between the reporter and the...