Lucene search
+L

2412 matches found

Snyk
Snyk
•added 2026/07/01 7:24 p.m.•13 views

External Control of File Name or Path

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

8.5CVSS5.9AI score0.0014EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/01 7:24 p.m.•14 views

External Control of File Name or Path

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

8.5CVSS5.9AI score0.0014EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/01 7:24 p.m.•16 views

External Control of File Name or Path

Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

8.5CVSS5.9AI score0.0014EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
•added 2026/07/01 11:30 a.m.•27 views

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

6.7AI score0.00683EPSS
SaveExploits1References8
PyPA
PyPA
•added 2026/06/29 11:50 a.m.•19 views

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

SummaryThe logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands including...

9.3CVSS6.1AI score0.00525EPSS
SaveExploits0References7Affected Software1
OSV
OSV
•added 2026/06/29 11:50 a.m.•19 views

PYSEC-2026-544 MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

Summary The logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands including...

9.3CVSS6AI score0.00525EPSS
SaveExploits0References7
PyPA
PyPA
•added 2026/06/29 11:50 a.m.•20 views

External Control of File Name or Path in h2oai/h2o-3

Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting ...

9.3CVSS7.3AI score0.00721EPSS
SaveExploits1References6Affected Software1
OSV
OSV
•added 2026/06/29 11:50 a.m.•26 views

PYSEC-2026-350 External Control of File Name or Path in h2oai/h2o-3

Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting ...

9.3CVSS7.5AI score0.00721EPSS
SaveExploits1References6
OSV
OSV
•added 2026/06/29 11:50 a.m.•23 views

PYSEC-2026-324 DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises...

9.1CVSS7.5AI score0.00823EPSS
SaveExploits1References6
Positive Technologies
Positive Technologies
•added 2026/06/29 12:00 a.m.•23 views

PT-2026-53613

Summary The log file name parameter in the stata do API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands includi...

9.3CVSS6.1AI score0.00525EPSS
SaveExploits0References8
BDU FSTEC
BDU FSTEC
•added 2026/06/29 12:00 a.m.•13 views

The vulnerability of the integrated development environment for programming languages like GoLand arises from improper external control of file names or file paths, allowing an attacker to execute arbitrary code.

The vulnerability of the GoLand integrated development environment is related to incorrect external control of file names or file paths. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

7.5CVSS6.1AI score0.00453EPSS
SaveExploits0References2Affected Software1
Snyk
Snyk
•added 2026/06/27 12:12 a.m.•20 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the patch-remove process. An attacker can cause deletion of arbitrary files outside the intended directory by crafting a patch entry that resolves outside the configured patches directory...

7.1CVSS5.9AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
•added 2026/06/27 12:02 a.m.•26 views

External Control of File Name or Path

Overview @pnpm/installing.deps-restorer is a Fast installation using only pnpm-lock.yaml Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodul...

7.1CVSS5.8AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
•added 2026/06/26 6:47 p.m.•11 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via unsanitized handling of the uploadId parameter in the multipart upload process. An attacker can create arbitrary files on the host system, potentially leading to arbitrary command execution, by...

9.9CVSS6AI score0.00731EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/26 6:46 p.m.•11 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via a crafted symlink in the templates directory during image import or instance backup restoration processes. An attacker can access and modify arbitrary files on the host system, potentially leadi...

9.9CVSS6AI score0.00731EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/26 6:46 p.m.•11 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via a crafted symlink in the templates directory during image import or instance backup restoration processes. An attacker can access and modify arbitrary files on the host system, potentially leadi...

9.9CVSS6AI score0.00731EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/26 6:32 p.m.•10 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the record-output process. An attacker can create or overwrite files on the host system by exploiting a crafted symlink in a container image, which can lead to arbitrary command execution...

9.9CVSS6AI score0.00731EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/26 6:32 p.m.•13 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the record-output process. An attacker can create or overwrite files on the host system by exploiting a crafted symlink in a container image, which can lead to arbitrary command execution...

9.9CVSS6AI score0.00731EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/26 6:31 p.m.•11 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the rootfs symlink during image extraction. An attacker can gain unauthorized access to sensitive files and perform arbitrary file creation or modification on the host by importing a special...

9.9CVSS6AI score0.00731EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
•added 2026/06/25 11:00 a.m.•25 views

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

6.7AI score0.00683EPSS
SaveExploits1References8
Rows per page
Query Builder