2660 matches found
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Added a sanity check for the file name. The length of the file name should be smaller than the directory entry size...
Astra Linux – Vulnerability in Ruby 2.5
In RDoc 3.11 through 6.x, as distributed with Ruby up to 3.0.1, it was possible to execute arbitrary code using | and tags within a filename...
Astra Linux – Vulnerability in curl
Curl versions 7.20.0 through 7.70.0 are vulnerable to improper restrictions on the names of files and other resources, which can lead to overwriting of local files when the -J flag is used...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15
A flaw was discovered in the exFAT driver of the Linux kernel. The vulnerability resides in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long...
Astra Linux – Vulnerability in Poppler
A issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, which can lead to a denial of service. This issue is evident in utils/pdfdetach.cc, where it does not validate the filename of an embedded file before constructing a save path...
CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)
Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...
CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)
Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...
CVE-2026-54165
Dobase , an open-source self-hosted workspace, is affected by a one-click stored DOM-based XSS in its public shared-folder image gallery. The root cause is that a file's name attribute is fully attacker-controlled and never sanitized; it is round-tripped through an ERB-escaped data-name attribute...
EUVD-2026-76695
Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...
The vulnerability of the Skype for Business Server’s instant messaging program, related to improper external management of file names or paths, allows a hacker to execute arbitrary code.
The vulnerability of the Skype for Business Server’s instant messaging program is related to improper external management of the file name or path. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
External Control of File Name or Path
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to External Control of File Name or Path in the category EULA text field processing during the rendering of checkout confirmation emails. An attacker can access sensitive files...
External Control of File Name or Path
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to External Control of File Name or Path via improper sanitization of markdown image syntax in note fields. An attacker can access sensitive server files and perform unauthoriz...
CVE-2026-79692
Dell Secure Connect Gateway (SCG) 5.0 Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00) contain an External Control of File Name or Path vulnerability. An unauthenticated remote attacker could exploit this flaw to gain filesystem access . The Dell-assigned CV...
CVE-2026-79692: External Control of File Name or Path
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the store process. An attacker can overwrite arbitrary existing files writable by the PHP process with partially controlled content by supplying a crafted export path, potentially leading to...
CVE-2026-66302
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network...
EUVD-2026-74044
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network...
CVE-2026-69383
External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...