491713 matches found
CVE-2014-125133
The NativeChurch theme for WordPress (versions before 1.6.2 ) is vulnerable to a path traversal vulnerability. Unauthenticated attackers can exploit the file parameter of download.php by sending GET requests containing directory traversal sequences. This allows for the arbitrary download of sensi...
CVE-2026-9827
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2026-9827
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2026-9827
The Totolink X2000R router (version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) is vulnerable to an arbitrary file write in the boa binary's formUploadFile functionality. An authenticated attacker can send a specially crafted HTTP request to the /boafrm/formUploadFile page. The vulnerability is ca...
EUVD-2026-105333
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2026-92390
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-92390
When invoked with "--remote-header-name" "-J", curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an "ETag" header is processed before "Content-Disposition" under "--etag-save". This flaw allows an...
CVE-2026-92390
The curl utility (versions prior to 8.23.0 ) is vulnerable to a local file overwrite flaw when using the --remote-header-name (-J) flag. The root cause is a failure to preserve documented anti-clobbering protections under specific conditions: if an intermediate 103 Early Hints response precedes t...
EUVD-2026-105320
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-113721
A flaw was found in virtualenv. A local attacker can exploit this issue by pre-creating symbolic or hard links in a destination directory before an environment is set up. Because virtualenv does not properly check or replace existing links when writing configuration and activation files, it can...
AZL-110121 CVE-2026-113719 affecting package python-virtualenv 20.36.1-9
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...
DEBIAN-CVE-2026-113719
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...
CVE-2026-113719
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...
DEBIAN-CVE-2026-113721
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...
CVE-2026-113721
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...
CVE-2026-113719
A flaw was found in virtualenv. This vulnerability allows a local attacker to cause arbitrary file deletion outside the target environment directory. When creating an isolated environment in a reused directory, virtualenv processes existing package metadata during cleanup without verifying that...
CVE-2026-113716
A flaw was found in virtualenv. When creating an isolated environment, directory validation resolves existing symbolic links symlinks rather than verifying the intended target destination. A local attacker could exploit this vulnerability by pre-creating a directory tree containing symlinks...
CVE-2026-112948
A flaw was found in vitest. Vitest development servers fail to properly enforce file access restrictions, permitting access to paths that should be denied. An attacker who can reach an affected development server or who tricks a user into visiting a malicious website can exploit this flaw to read...