ROS-20250710-06

The Redis database management system DBMS vulnerability is related to boundary checking errors in parsing file names. Exploitation of the vulnerability could allow an attacker to execute arbitrary code...

CVE-2025-49760

External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network...

Windows Storage Spoofing Vulnerability

External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network...

CVE-2025-7098

A vulnerability, which was classified as critical, was found in Comodo Internet Security Premium 12.3.4.8162. Affected is an unknown function of the component File Name Handler. The manipulation of the argument name/folder leads to path traversal. It is possible to launch the attack remotely. The...

CVE-2025-7098 Comodo Internet Security Premium File Name path traversal

A vulnerability, which was classified as critical, was found in Comodo Internet Security Premium 12.3.4.8162. Affected is an unknown function of the component File Name Handler. The manipulation of the argument name/folder leads to path traversal. It is possible to launch the attack remotely. The...

PT-2025-28093 · Comodo · Comodo Internet Security Premium

Name of the Vulnerable Software and Affected Versions: Comodo Internet Security Premium version 12.3.4.8162 Description: A critical vulnerability was found in the File Name Handler component, where the manipulation of the name/folder argument leads to path traversal. The attack can be launched...

CVE-2024-13451

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing...

USN-7601-1 libarchive vulnerabilities

It was discovered that libarchive incorrectly handled certain RAR archive files. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. CVE-2025-5914 It was discovered that libarchive incorrectly handled certain RAR archive files. An attacker could...

External Control of File Name or Path

Overview ServiceStack.Text is a set of JSON, JSV and CSV text serializers Affected versions of this package are vulnerable to External Control of File Name or Path in the url parameter to the GetErrorResponse method. An attacker can relay NTLM credentials in the context of the current user by...

undertow: OutOfMemoryError due to @MultipartConfig handling

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service DoS attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass...

TOTOLINK CA300-PoE 命令注入漏洞

The TOTOLINK CA300-PoE is a wireless access point device manufactured by China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the improper handling of the parameter FileName in the file upgrade.so, no details of the vulnerability are...

The vulnerability of the server of the surveillance and recording system for AXIS Camera Station Pro allows a intruder to create or modify arbitrary files.

The vulnerability of the surveillance and recording system server for AXIS Camera Station Pro relates to improper external management of file names or files. Exploiting this vulnerability can allow attackers to create or modify arbitrary files...

The vulnerability of the SLNX PC Client of the embedded application and document management tool RICOH Streamline NX allows a perpetrator to re-record any files.

The vulnerability of the SLNX PC Client of the embedded application and document management tool RICOH Streamline NX relates to improper external manipulation of file names or file paths. Exploiting this vulnerability allows a malicious actor to re-record arbitrary files...

The vulnerability of the Windows Security App antivirus program on the Windows operating system allows attackers to perform spear-phishing attacks.

The vulnerability of the Windows Security App antivirus program in the Windows operating system is related to improper external manipulation of the file name or path. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks...

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the incorrect limitation of file names and other resources, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise is related to incorrect restrictions on file names and other resources. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code...

ROS-20250619-03

A vulnerability in the Microsoft Visual Studio software development tool, the Microsoft.NET software platform, and the Build Tools for Visual Studio toolkit is associated with an incorrect external external vulnerability. Microsoft.NET and Build Tools for Visual Studio toolkit is related to...

CVE-2025-36506

External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted request, arbitrary files in the file system can be overwritten with log data...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages lies in the incorrect limitation of file names and other resources, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to incorrect restrictions on file names and other resources. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

CVE-2025-47956

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...

External Control of File Name or Path

Overview OctoPrint is a snappy web interface for your 3D printer Affected versions of this package are vulnerable to External Control of File Name or Path via the upload endpoints. An attacker with the FILEUPLOAD permission can move files from the host into the upload folder, from where they can ...