CVE-2024-5827

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...

CVE-2024-8885

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files...

CVE-2025-0851

A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library DJL on all platforms allows a bad actor to write files to arbitrary locations...

CVE-2025-0851 Path traversal issue in Deep Java Library

A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library DJL on all platforms allows a bad actor to write files to arbitrary locations...

CVE-2024-12087 Rsync: path traversal vulnerability in rsync

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...

CVE-2024-54724

PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusion...

CVE-2024-54724

CVE-2024-54724 affects PHPYun prior to 7.0.2. The documented vulnerability allows code execution through backdoor‑restricted arbitrary file writing and file inclusion. Public sources indicate a high‑severity impact (CVSS v3.1: 9.8, CRITICAL, network access, no privileges required, no user interac...

CVE-2024-54724

PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusion...

CVE-2024-55459

An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the getfile function...

CVE-2024-56514 Karmada Tar Slips in CRDs archive extraction

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...

CVE-2024-47151

Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution...

CVE-2024-47151

Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution...

CVE-2024-47151

Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution...

CVE-2024-47151

Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution...

CVE-2024-47151

Honor MagicOS is affected by CVE-2024-47151 due to a file write vulnerability that could lead to code execution on successful exploitation. CNNVD describes the issue in MagicOS and notes a specific affected version: 8.0.0.135. The connected documents provide limited technical detail beyond the ex...

PT-2024-32439 · Honor · Honor Products

Name of the Vulnerable Software and Affected Versions: Honor products affected versions not specified Description: The issue concerns a file writing vulnerability in certain Honor products. Successful exploitation of this vulnerability could lead to code execution. Recommendations: At the moment,...

PlexTrac 安全漏洞

PlexTrac is a penetration test reporting and management platform from PlexTrac Inc. in the United States. A security vulnerability exists in PlexTrac versions prior to 1.61.3 through 2.8.1 that stems from an untrustworthy data deserialization vulnerability in the Runbook module, which allows obje...

USN-7153-1: PHP vulnerability

It was discovered that PHP incorrectly handled long string inputs in two database drivers. An attacker could possibly use this issue to write files in locations they would not normally have access to. CVE-2024-11236...

[SECURITY] [DLA 3968-1] netatalk security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3968-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz November 28, 2024 https://wiki.debian.org/LTS -...

Path Traversal

net.sf.mpxj, mpxj is vulnerable to Path Traversal. The vulnerability is due to an incomplete patch for CVE-2020-35460, which still allows the construction of malicious paths to write files to arbitrary locations...