SRC-2025-0006 : Samsung MagicINFO 9 Server MagicInfoWebAuthorClient ContentSaveServiceImpl writeXmlToFile File Write Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung MagicINFO 9 Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the ContentSaveServiceImpl class. The issue results from t...

CVE-2025-58755 MONAI has path traversal issue that may lead to arbitrary file writes

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The extractall function zipfile.extractalloutputdir is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious...

CVE-2025-58755

MONAI v1.5.0 and earlier is vulnerable to a path traversal/Zip Slip issue caused by using zip_file.extractall(output_dir) to extract archives. A crafted zip can overwrite arbitrary files on the target system when decompressed, as demonstrated by reports and security advisories referencing this be...

CVE-2025-58755 MONAI has path traversal issue that may lead to arbitrary file writes

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The extractall function zipfile.extractalloutputdir is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious...

Directory Traversal

github.com/containers/podman is vulnerable to Directory Traversal.The vulnerability is due to a lack of symlink canonicalization and host-path validation; this allows an attacker who supplies a malicious Kubernetes YAML to cause podman to write the ConfigMap/Secret data contents are defined by th...

CVE-2025-58355

Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0...

internetarchive 路径遍历漏洞

internetarchive is a Python library by the individual developer jjjake. A path traversal vulnerability exists in internetarchive 5.5.0 and earlier versions, which stems from path traversal and could lead to arbitrary file writes...

CVE-2025-20335

A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is due to a lack of proper authenticatio...

PT-2025-35796

Name of the Vulnerable Software and Affected Versions Memos version 0.22 Description When configured to store objects locally, the software allows an attacker to create a file via the CreateResource endpoint. This is achieved by including a path traversal sequence in the file name, enabling...

Memos 安全漏洞

Memos is a Memos open source open source hosted meme center with knowledge management and social features. A security vulnerability exists in Memos version 0.22, which stems from the presence of path traversal in the CreateResource endpoint, which could lead to arbitrary file writes...

PT-2025-35813

Name of the Vulnerable Software and Affected Versions Cisco Desk Phone 9800 Series Cisco IP Phone 7800 and 8800 Series Cisco Video Phone 8875 Description A vulnerability exists in the directory permissions of the affected devices, potentially allowing an unauthenticated, remote attacker to write...

Linux Distros Unpatched Vulnerability : CVE-2023-7216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially...

Mobile Security Framework 路径遍历漏洞

Mobile Security Framework MobSF is an automated all-in-one mobile application from Mobile Security Framework open source. Used for penetration testing, malware analysis and security assessments, it is capable of performing both static and dynamic analysis. A path traversal vulnerability exists in...

CVE-2025-57773

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2024-55459

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the getfile function...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper sanitization of the upload path in the upload process. An attacker can write arbitrary files to any location on the file system, potentially compromising the server, by sending a crafted upload request...

Harness 安全漏洞

Harness is a development platform open-sourced by Harness. A security vulnerability exists in Harness versions prior to 3.3.0, which stems from an improperly cleaned upload path that could lead to arbitrary file writes...

The vulnerability of the Bootstrap Loading component in Cisco IOS XE operating systems allows a hacker to write arbitrary files.

The vulnerability of the Bootstrap Loading component in Cisco IOS XE operating systems is related to the improper validation of the specified input type. Exploiting this vulnerability allows an attacker to write arbitrary files...

PT-2025-34683

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.12 Description: DataEase is an open source business intelligence and data visualization tool. Due to insufficient filtering of DB2 parameters, a JNDI injection attack can be launched, triggering an AspectJWeave...

Linux Distros Unpatched Vulnerability : CVE-2015-1194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive. CVE-2015-1194 Note that Nessus relies on the presence of...