CVE-2025-46835

Git GUI is vulnerable to arbitrary file creation/overwrites when a user clones an untrusted repository and is tricked into editing a file under a maliciously named directory; this can affect files the user can write. The issue is fixed in Git GUI versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2...

CVE-2025-46835 Git GUI can create and overwrite files for which the user has write permission

Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permissio...

CVE-2025-27613

Gitk (the Tcl/Tk based Git history browser) is affected by CVE-2025-27613. When a user clones an untrusted repository and runs gitk without extra arguments, files that the user can write to may be created and truncated. The vulnerability is triggered by the per-file encoding option in Gitk’s Pref...

CVE-2025-27613

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled...

USN-7626-1: Git vulnerabilities

Avi Halachmi discovered that Git incorrectly managed file modification constraints with Gitk. An attacker could possibly use this issue to create or write to arbitrary files on the system. CVE-2025-27613 Avi Halachmi discovered that Git incorrectly handled arguments when invoking the Gitk utility...

GitHub: CVE-2025-27613 Gitk Arguments Vulnerability

CVE-2025-27613 is regarding a vulnerability in Gitk where when a user clones an untrusted repository and runs Gitk without additional command arguments, any writable file can be created and truncated. The option "Support per-file encoding" must have been enabled. The operation "Show origin of thi...

Gitk 操作系统命令注入漏洞

Gitk is an open source graphical tool that comes with Git to view information such as commit history and branch structure of Git repositories. Gitk suffers from an operating system command injection vulnerability that stems from the ability to create and truncate any writable file when a user...

SUSE-SU-2025:02198-1 Security update for runc

This update for runc fixes the following issues: - CVE-2024-45310: Fixed unintentional creation of empty files/directories on host bsc1230092 Other fixes: - Update to runc v1.2.6...

CVE-2025-3722

A path traversal vulnerability in System Information Reporter SIR 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System Information Reporter, leading to creation of files anywhere on the filesystem and possibly overwriting existing files and...

OESA-2025-1670 plexus-archiver security update

The Plexus project provides a full software stack for creating and executing software projects. It provides a number of pre-built components for common tasks and toolkits such as Jetty, Velocity, Hibernate, i18n, and many more. However, Plexus is also able to reuse your existing components writte...

PT-2025-27269 · Marvell · Qconvergeconsole

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole affected versions not specified Description: This issue allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole without requiring authentication. The flaw exists within...

PT-2025-27274 · Marvell · Qconvergeconsole

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole affected versions not specified Description: This issue allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole without requiring authentication. The problem lies in the...

CVE-2025-3722

A path traversal vulnerability in System Information Reporter SIR 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System Information Reporter, leading to creation of files anywhere on the filesystem and possibly overwriting existing files and...

CVE-2025-3722

A path traversal vulnerability in System Information Reporter SIR 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System Information Reporter, leading to creation of files anywhere on the filesystem and possibly overwriting existing files and...

CVE-2025-3722

A path traversal vulnerability in System Information Reporter SIR 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System Information Reporter, leading to creation of files anywhere on the filesystem and possibly overwriting existing files and...

CVE-2025-3722

The CVE-2025-3722 entry describes a path traversal vulnerability in System Information Reporter (SIR) versions 1.0.3 and earlier. An authenticated, high-privileged user could issue malicious ePO post requests to SIR, enabling creation of files anywhere on the filesystem, with possible overwriting...

SUSE-SU-2025:02120-1 Security update for go1.24-openssl

This update for go1.24-openssl fixes the following issues: Update to version 1.24.4 bsc1236217: - CVE-2025-22874 crypto/x509: ExtKeyUsageAny bypasses policy validation bsc1244158. - CVE-2025-0913 os: inconsistent handling of OCREATE|OEXCL on Unix and Windows bsc1244157. - CVE-2025-4673 net/http:...

CVE-2025-3722: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in System Information Reporter SIR 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System Information Reporter, leading to creation of files anywhere on the filesystem and possibly overwriting existing files and...

K000151924: runc vulnerability CVE-2024-45310

Security Advisory Description runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a...

The vulnerability of the server of the surveillance and recording system for AXIS Camera Station Pro allows a intruder to create or modify arbitrary files.

The vulnerability of the surveillance and recording system server for AXIS Camera Station Pro relates to improper external management of file names or files. Exploiting this vulnerability can allow attackers to create or modify arbitrary files...