DEBIAN-CVE-2025-54293

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links...

UBUNTU-CVE-2025-54293

Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links...

The filename of uploaded files vulnerable to stored XSS in Bolt CMS

...

TOTOLINK X6000R sub_417D74 function command injection vulnerability

TOTOLINK X6000R is a wireless router supporting Wi-Fi 6 technology from China's Gion Electronics TOTOLINK, focusing on high concurrent connections and dual-band transmission capabilities. The TOTOLINK X6000R suffers from a command injection vulnerability that stems from the failure to properly...

CVE-2025-58753 copyparty: Sharing a single file does not fully restrict access to other files in source folder

Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature the shr global-option. When a share was created for just one file inside a folder, it was possible to access the other files inside that folder by guessing the filenames. I...

Ivanti Endpoint Manager 安全漏洞

Ivanti Endpoint Manager is a unified endpoint management solution for multiple operating systems such as Windows, macOS, Linux, Chrome OS and supports IoT devices. A code execution vulnerability exists in Ivanti Endpoint Manager that stems from a lack of adequate validation of filenames of upload...

Ivanti Endpoint Manager 安全漏洞

Ivanti Endpoint Manager is a unified endpoint management solution for multiple operating systems such as Windows, macOS, Linux, Chrome OS and supports IoT devices. A code execution vulnerability exists in Ivanti Endpoint Manager that stems from insufficient validation of filenames of uploaded...

GO-2025-3910 Mattermost Fails to Sanitize File Names in github.com/mattermost/mattermost-server

Mattermost Fails to Sanitize File Names in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

Linux Distros Unpatched Vulnerability : CVE-2023-5512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions startin...

Linux Distros Unpatched Vulnerability : CVE-2020-15121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the...

CVE-2025-54301

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped...

CVE-2025-54301

CVE-2025-54301 affects the Quantum Manager component for Joomla (versions 1.0.0–3.2.0). The vulnerability is a stored XSS caused by file names not being properly escaped, as described in multiple sources. No exploitation details are provided in the documents, and a concrete patched version is not...

CVE-2025-54301: Improper Neutralization of Input During Web Page Generation

A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped...

Linux Distros Unpatched Vulnerability : CVE-2014-6311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - generatedoygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges...

The vulnerability of the Golang programming language lies in improper external control of file names or paths, allowing attackers to execute arbitrary code.

The vulnerability of the Go programming language is related to incorrect external manipulation of file names or file paths. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20250814-12

EMACS text editor vulnerability is related to incorrect input validation of the org-babel-execute:latex in ob-latex.el when processing file or directory names. Exploitation of the vulnerability could allow an attacker to execute arbitrary code...

PT-2025-33085 · Realnetworks · Netzip Classic

Name of the Vulnerable Software and Affected Versions: Real Networks Netzip Classic version 7.5.1.86 Description: Real Networks Netzip Classic version 7.5.1.86 is susceptible to a stack-based buffer overflow when parsing a specially crafted ZIP archive. The issue occurs when the application...

PT-2025-32851 · Microsoft · Windows Security App

Name of the Vulnerable Software and Affected Versions: Windows Security App affected versions not specified Description: The Windows Security App contains a flaw related to external control of file names or paths. This allows an authorized attacker to perform local spoofing. Recommendations: At t...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the unzipFile function in the client.go file, which uses filepath.JoindestDir, f.Name without validating or sanitizing f.Name. An attacker can overwrite arbitrary files on the system outside of the intended...

The vulnerability of the PAN-OS operating system, related to incorrect external management of file names or file paths, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the PAN-OS operating system is related to incorrect external management of file names or file paths. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...