CVE-2024-11343: Improper Limitation of a Pathname to a Restricted Directory

In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 2025.1.205, unzipping an archive can lead to arbitrary file system access...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved by improving access restrictions to the file system. This issue is fixed in Safari 18.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, and visionOS 2.3. A maliciously crafted webpage may be able to obtain user fingerprints...

SUSE CVE-2025-24143

The issue was addressed with improved access restrictions to the file system. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, visionOS 2.3. A maliciously crafted webpage may be able to fingerprint the user...

CVE-2022-45092

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 1. An authenticated remote attacker with access to the Web Based Management 443/tcp of the affected product, could potentially read and write arbitrary files from and to the device's file system. An attacker might...

CVE-2024-20398

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI...

CVE-2024-31978

A vulnerability has been identified in SINEC NMS All versions V2.0 SP2. Affected devices allow authenticated users to export monitoring data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacker to download files from the file system. Under...

CVE-2024-22415

jupyter-lsp is a coding assistance tool for JupyterLab code navigation + hover suggestions + linters + autocompletion + rename using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control on the operating system level, and with...

CVE-2025-24963

CVE-2025-24963 concerns Vitest browser-mode HTTP server. The vulnerability arises from the __screenshot-error handler, which can respond with arbitrary files from the host filesystem when the browser-mode server is exposed to the network (e.g., via browser.api.host: true). Under these conditions,...

Vitest browser mode serves arbitrary files

Summary screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host: true, an attacker can send a request to that handler from remote to get the content of arbitrary files. Details This...

CVE-2024-54557

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An attacker may gain access to protected parts of the file system...

CVE-2024-54557

CVE-2024-54557 affects macOS via a logic issue in SharedFileList that could allow access to protected parts of the file system. The fixed revisions are macOS Sonoma 14.7.2, macOS Sequoia 15.2, and macOS Ventura 13.7.2. The issue is described as a logic restriction problem; no exploit details are ...

CVE-2024-54557: Improper Preservation of Permissions

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An attacker may gain access to protected parts of the file system...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS version 15.2, which originates from the possibility that an attacker could access protected portions of the file system...

iocharger 安全漏洞

iocharger is an electric vehicle charging and smart energy management solution from Galaxy Zhangtan iocharger, a Chinese company. A security vulnerability exists in iocharger. An attacker exploiting the vulnerability could download any file on the file system...

CVE-2024-53961 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outsid...

CVE-2024-38819

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

CVE-2024-47480

Dell Inventory Collector Client is affected in versions prior to 12.7.0 by an Improper Link Resolution Before File Access vulnerability. The root cause is improper link resolution that may allow a low-privilege, locally authenticated attacker to gain Elevation of Privileges and unauthorized file ...

CVE-2024-47480: UNIX Symbolic Link (Symlink) Following

Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with local access may exploit this vulnerability, potentially resulting in Elevation of Privileges and unauthorized file system access...

Insufficient Permission Checks

org.jenkins-ci.plugins, script-security is vulnerable to insufficient permission checks. The vulnerability is due to the lack of a permission check in a method that implements form validation, allows attackers with Overall/Read permission to access and check for the existence of files on the...

GO-2024-3293 Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5

Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go...