CVE-2024-13991

Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the fullPath parameter of the /fileDownload?action=downloadBackupFile endpoint and retrieve files from the server filesystem. VulnCheck has observed...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A security vulnerability exists in F5 BIG-IP that stems from a directory traversal vulnerability that could allow an authenticated attacker to...

The vulnerability of the 7-Zip file archiver lies in the improper handling of symbolic links before accessing a file, allowing an attacker to execute arbitrary code.

The vulnerability of the 7-Zip file archiver is related to the incorrect handling of symbolic links before accessing the file. Exploiting this vulnerability allows an attacker to execute arbitrary code, provided that the user opens a specially crafted ZIP archive...

CVE-2025-62363

yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path to the yt-dlp executable via the pathtoytdlp configuration setting. An attacker with write access to the configuration file or the filesyst...

EUVD-2025-34366

Improper link resolution before file access 'link following' in XBox Gaming Services allows an authorized attacker to elevate privileges locally...

EUVD-2025-34277

Improper link resolution before file access 'link following' in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally...

EUVD-2025-34265

Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via improper handling of symbolic links before file access. An attacker can gain elevated privileges by exploiting the way the system resolves links, potentially accessing or modifying files with higher permissions...

CVE-2025-59281

Improper link resolution before file access 'link following' in XBox Gaming Services allows an authorized attacker to elevate privileges locally...

CVE-2025-59241

Improper link resolution before file access 'link following' in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally...

CVE-2025-55247

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2025-55247

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

PT-2025-42008

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description An issue exists in .NET where improper link resolution before file access, also known as 'link following', can allow an authorized attacker to elevate privileges locally. This occurs due to the...

HPESBNW04957 rev.1 - HPE Aruba Networking AOS-10 and AOS-8 Mobility Conductor, Controllers, and Gateways, Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary Command Execution, Arbitrary File Deletion, Arbitrary File Download, Creation and Deletion of Arbitrary Files, Execution of Arbitrary Commands, Unauthorized Access to Files, Unauthorized Arbitrary Command Execution, Unauthorized Data Modification,...

PT-2025-42124

Name of the Vulnerable Software and Affected Versions Windows Health and Optimized Experiences Service affected versions not specified Description An issue exists in Windows Health and Optimized Experiences Service related to improper link resolution before file access, also known as 'link...

UBUNTU-CVE-2025-55247

Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2025-11569

All versions of the package cross-zip are vulnerable to Directory Traversal via consecutive usage of zipSync and unzipSync functions that allow arguments such as dirname. An attacker can access system files by selectively doing zip/unzip operations...

EUVD-2025-33658

cross-zip is vulnerable to Directory Traversal through selective use of zip/unzip operations...

CVE-2025-11569

The connected data identifies a concrete vulnerability in the cross-zip JavaScript package. A Directory Traversal flaw exists when repeatedly using zipSync() and unzipSync() with arguments such as __dirname, allowing an attacker to access host system files. Red Hat lists all versions of cross-zip...