CVE-2025-24170

CVE-2025-24170 is a macOS vulnerability described as a logic issue in improved file handling that could allow an app to gain root privileges. The vulnerability is fixed in macOS Ventura 13.7.5 and macOS Sonoma 14.7.5. Connected documents confirm the issue’s root cause as a file-handling logic fla...

CVE-2025-24170

A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to gain root privileges...

Security update for restic (moderate)

openSUSE Security Update: Security update for restic Announcement ID: openSUSE-SU-2025:0110-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP6 An update that contains security fixes can now be installed. Description: This update for restic fixes the following issues:...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems from the U.S. company Apple Apple developed specifically for Mac computers. A security vulnerability exists in Apple macOS Sequoia, which stems from improper file handling and could lead to application access to contacts...

OpenManus 安全漏洞

OpenManus is an application by mannaandpoem individual developers. A security vulnerability exists in OpenManus version 2025.3.13 and earlier, which stems from an improper access control issue in the file handling component...

Denial Of Service (DoS)

Gradio is vulnerable to a Denial of Service DoS. The vulnerability is due to improper file handling due to the dataframe component using pd.readcsv, which accepts compressed files, allowing an attacker to upload a zip bomb that crashes the server...

CVE-2024-54525

A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Restoring a maliciously crafted backup file may lead to modification of protected system files...

Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint

In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the downloadmodel endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's...

CVE-2024-7773

Rejected reason: REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-45436. Notes: All CVE users should reference CVE-2024-45436 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage...

PT-2025-12133 · Unknown +1 · Binary-Husky/Gpt Academic +1

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version git 310122f Description: A vulnerability in binary-husky/gpt academic allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python...

MGASA-2025-0105 Updated tomcat packages fix security vulnerabilities

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensiti...

CVE-2025-30153 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

FlowiseAI Arbitrary File Upload

Flowise is vulnerable to an attack allowing an unauthenticated attacker to upload an arbitrary file. This detection is included in the AI and LLM category. Note that this plugin requires the 'File Upload' assessment option enabled in the scan configuration. No source data...

NI Vision Builder AI（NI VBAI） 安全漏洞

NI Vision Builder AI NI VBAI is a National Instruments NI software for creating vision applications without programming. It is used to create, calibrate, and deploy vision applications for automated inspection. A security vulnerability exists in NI Vision Builder AI NI VBAI that stems from a lack...

RLSA-2024:9102 Moderate: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Symlink error leads to information disclosure CVE-2022-4122 containers/image:...

RLSA-2024:9470 Low: cups security update

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups: libppd: remote command injection via attacker controlled data in PPD file For more details about the security issues, including the impact, a CVSS score,...

CVE-2024-54525

A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Restoring a maliciously crafted backup file may lead to modification of protected system files...

CVE-2024-54525

A logic issue was addressed with improved file handling. This issue is fixed in visionOS 2.2, watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2. Restoring a maliciously crafted backup file may lead to modification of protected system files...

CVE-2024-54525

A logic issue was addressed with improved file handling. This issue is fixed in visionOS 2.2, watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2. Restoring a maliciously crafted backup file may lead to modification of protected system files...

CVE-2024-54525

A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Restoring a maliciously crafted backup file may lead to modification of protected system files...