CLSA-2025-1752576917 git: Fix of CVE-2025-48385

CVE-2025-48385: bundle-uri: fix arbitrary file writes via parameter injection...

Siemens SINEC NMS Path Traversal Vulnerability (CNVD-2025-16629)

Siemens SINEC NMS is a network management system NMS from Siemens, Germany, that can be used 24/7 to centrally monitor, manage and configure industrial networks with tens of thousands of devices, including safety-related areas. A path traversal vulnerability exists in Siemens SINEC NMS that stems...

WordPress plugin Premium Age Verification Restriction for WordPress 信任管理问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A trust management issue vulnerability exis...

The vulnerability of the Solutions App operating system, ctrlX OS, allows a perpetrator to write arbitrary files to arbitrary locations within the file system.

The vulnerability of the Solutions App operating system ctrlX OS is related to errors in processing relative path operations when accessing directories. Exploiting this vulnerability allows a malicious actor to write arbitrary files to arbitrary locations in the file system by sending specially...

PT-2025-40805

Name of the Vulnerable Software and Affected Versions allegroai/clearml version v2.0.1 Description A flaw exists in the handling of symbolic and hard links within the safe extract function, leading to a path traversal issue. This can result in arbitrary file writes outside the intended directory...

CVE-2025-48385 Git alllows arbitrary file writes via bundle-uri parameter injection

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to...

CVE-2025-48385 Git alllows arbitrary file writes via bundle-uri parameter injection

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to...

USN-7626-1 git vulnerabilities

Avi Halachmi discovered that Git incorrectly managed file modification constraints with Gitk. An attacker could possibly use this issue to create or write to arbitrary files on the system. CVE-2025-27613 Avi Halachmi discovered that Git incorrectly handled arguments when invoking the Gitk utility...

CVE-2025-40738

A vulnerability has been identified in SINEC NMS All versions V4.0. The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privilege...

Siemens SINEC NMS 路径遍历漏洞

Siemens SINEC NMS is a network management system NMS from Siemens, Germany, that can be used 24/7 to centrally monitor, manage and configure industrial networks with tens of thousands of devices, including safety-related areas. A path traversal vulnerability exists in Siemens SINEC NMS that stems...

Marvell QConvergeConsole 路径遍历漏洞

Marvell QConvergeConsole is a cross-data center unified adapter management software from Marvell, Inc. A path traversal vulnerability exists in Marvell QConvergeConsole that stems from the decryptFile method not properly validating a user-supplied path, which could lead to arbitrary file writes...

Infinera G42 安全漏洞

Infinera G42 is a modular platform for optical networks from Infinera, USA. A security vulnerability exists in Infinera G42 version R6.1.3 that stems from a directory traversal issue that could result in file reads and writes...

Infinera G42 安全漏洞

Infinera G42 is a modular platform for optical networks from Infinera, USA. A security vulnerability exists in Infinera G42 version R6.1.3, which stems from improper access control and could result in file reads and writes...

Directory Traversal

Overview langchain-chatchat is a Langchain-Chatchat formerly langchain-ChatGLM, local knowledge based LLM like ChatGLM, Qwen and Llama RAG and Agent app with langchain Affected versions of this package are vulnerable to Directory Traversal via the parsefile function in the...

CVE-2025-53098

Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the ".roo/mcp.json" file within the VS Code workspace. Because the MCP configuration format allows for execution of arbitrary commands, prior to version 3.20.3, it would...

CVE-2025-53098: Improper Neutralization of Special Elements used in a Command

Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the .roo/mcp.json file within the VS Code workspace. Because the MCP configuration format allows for execution of arbitrary commands, prior to version 3.20.3, it would hav...

The vulnerability of the Rockwell Automation FactoryTalk View SE HMI software lies in the lack of authentication for critical functions. This allows attackers to bypass security restrictions and write arbitrary files.

The vulnerability of the Rockwell Automation FactoryTalk View SE human-machine interface control software is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and write arbitrary files...

Schneider Electric EVLink WallBox Path Traversal Vulnerability

The Schneider Electric EVLink WallBox is a home charging station from the French company Schneider Electric. The Schneider Electric EVLink WallBox suffers from a path traversal vulnerability that stems from improperly restricted pathnames, which can be exploited by an attacker to cause arbitrary...

Uncontrolled Search Path Element

Overview Affected versions of this package are vulnerable to Uncontrolled Search Path Element via the unpack function, when using the CLI flag --remote-image on untrusted container images. An attacker can write arbitrary files to the host system. This allows the attacker to create or overwrite...

OSV-SCALIBR 安全漏洞

OSV-SCALIBR is an open source software portfolio analysis library from Google. A security vulnerability exists in OSV-SCALIBR, which stems from a path traversal problem in the unpack function that could lead to arbitrary file writes...