483542 matches found
CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...
CVE-2026-112950
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...
CVE-2026-112950
The Vitest testing framework (versions 4.1.11 to 4.1.12 and 5.0.3) is vulnerable to a path traversal flaw on Windows systems. The root cause is an inconsistency in how isFileLoadingAllowed and filesystem read operations interpret backslashes within packages/mocker/src/node/interceptorPlugin.ts. A...
CVE-2026-97400
In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...
CVE-2026-112944
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative...
CVE-2026-112935
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...
CVE-2026-112941
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the...
CVE-2026-112939
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...
CVE-2026-112906
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...
Chamilo-CVE-2023-4220-RCE-Exploit
CVE-2023-4220 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution Overview This repository contains a proof-of-concept PoC exploit for the vulnerability identified as CVE-2023-4220 in Chamilo LMS. This exploit leverages an unauthenticated file upload vulnerability, allowing remote...
CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...
CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...
CVE-2026-112948
The Vitest testing framework (versions 5.0.0-beta.6 through 5.0.5 ) contains a vulnerability where dev servers misapply server.fs.deny. The root cause is that project servers replace Vite's defaults, and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker reachi...
proftpd-sftp-copy-file-write
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · proftpd-sftp-copy-file-write proftpd-sftp-copy-file-write Class: Privilege leftover / File write Reach: Remote ProFTPD 1.3.9d f59f248 - proftpd.org contrib modsftp advertises copy-file once SFTPEngine is on...
CVE-2018-14083
CVE-2018-14083...
CVE-2024-36991
CVE-2024-36991 Path traversal vulnerability in Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10 that allows reading sensitive files...
Exploit for CVE-2026-106173
CVE-2026-106173 — FortiSIEM Path Traversal Vulnerability...
EUVD-2026-105045
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative...
CVE-2021-41773m
CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...