CVE-2025-59352 Dragonfly allows arbitrary file read and write on a peer machine

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal...

PT-2025-38271

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description Dragonfly’s gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations and to read arbitrary files. This can allow peers to...

USN-7748-1: Vim vulnerabilities

It was discovered that Vim incorrectly handled file extraction when opening maliciously crafted zip or tar archives. An attacker could possibly use this issue to create or overwrite files on the system and execute arbitrary code...

USN-7748-1 vim vulnerabilities

It was discovered that Vim incorrectly handled file extraction when opening maliciously crafted zip or tar archives. An attacker could possibly use this issue to create or overwrite files on the system and execute arbitrary code...

CLSA-2025-1756929133 git: Fix of CVE-2025-27613

CVE-2025-27613: fix issue with file creation and truncation when running gitk without additional command arguments from untrusted repositories...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs due to a LaTeX blocklist bypass in the LaTeX processing functionality. The LaTeX module fails to enforce its blocklist properly, allowing specially crafted malicious flashcards to create arbitrary...

UBUNTU-CVE-2025-7039

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

CVE-2025-7039

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

CVE-2025-7039 Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

SUSE CVE-2025-7039

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to...

PT-2025-35649

Name of the Vulnerable Software and Affected Versions Soft Serve versions prior to 0.10.0 Description Soft Serve is a self-hostable Git server for the command line. The SSH API allows attackers to create or override arbitrary files with uncontrolled data using the --output variable. Recommendatio...

SUSE SLES15: git / git-arch / git-core / git-cvs / git-daemon / git-doc / etc (SUSE-SU-2025:03037-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03037-1 advisory. Updated to 2.43.7 jscPED-13447: - CVE-2025-27613: Fixed arbitrary writable file creation and truncation in Gitk bsc1245938 -...

Linux Distros Unpatched Vulnerability : CVE-2021-25317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Clou...

Security update for git

This update for git fixes the following issues: Updated to 2.43.7 jscPED-13447: CVE-2025-27613: Fixed arbitrary writable file creation and truncation in Gitk bsc1245938 CVE-2025-27614: Fixed arbitrary script execution via repo clonation in Gitk bsc1245939 CVE-2025-46835: Fixed arbitrary writable...

CVE-2025-9474

A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. The attack requires a local approach...

SUSE-SU-2025:03022-1 Security update for git

This update for git fixes the following issues: - CVE-2025-27613: Fixed arbitrary writable file creation and truncation in Gitk bsc1245938 - CVE-2025-46835: Fixed arbitrary writable file creation when cloning untrusted repository in Git GUI bsc1245942 - CVE-2025-48384: Fixed arbitrary writable fi...

Linux Distros Unpatched Vulnerability : CVE-2020-29582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and...

Linux Distros Unpatched Vulnerability : CVE-2018-1000801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - okular version 18.08 and earlier contains a Directory Traversal vulnerability in function unpackDocumentArchive... in core/document.cpp that can result in...

CVE-2025-44002 Arbitrary File Creation via Symbolic Link leading to Denial-of-Service

Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during...

CVE-2025-44002 Arbitrary File Creation via Symbolic Link leading to Denial-of-Service

Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during...