1677 matches found
GHSA-8CC4-RFJ6-FHG4 pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
The path shortening function is used in pnpm： export function depPathToFilename depPath: string, maxLengthWithoutHash: number: string let filename = depPathToFilenameUnescapeddepPath.replace/\/:?"|/g, '+' if filename.includes'' filename = filename .replace/$/, '' .replace/\||/g, '' if...
CAIBA: Multicast Source Authentication for CAN through Reactive Bit Flipping
Controller Area Networks CANs are the backbone for reliable intra-vehicular communication. Recent cyberattacks have, however, exposed the weaknesses of CAN, which was designed without any security considerations in the 1980s. Current efforts to retrofit security via intrusion detection or message...
CVE-2025-43015
In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces...
PT-2025-16933 · WordPress · Wp Editor
Name of the Vulnerable Software and Affected Versions: WP Editor plugin for WordPress versions up to and including 1.2.9.1 Description: The WP Editor plugin for WordPress is susceptible to arbitrary file update due to a missing file path validation. This allows authenticated attackers with...
curl: freeing stack buffer in utf8asn1str
A vulnerability was found in cURL's utf8asn1str function in the ASN1 parser, which causes a denial of service due to a memory allocation flaw. This flaw allows a remote attacker to use a specially crafted TLS certificate, causing the function to invoke free on a 4-byte local stack buffer. While...
Medium: python3.11-pip
Issue Overview: Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. CVE-2007-4559...
PT-2025-13974 · Apple · Xcode +1
Name of the Vulnerable Software and Affected Versions: Xcode versions prior to 16.3 Description: The issue allows an app to potentially overwrite arbitrary files due to inadequate state management. This has been addressed through improved state management. Recommendations: For versions prior to...
CVE-2025-30358 Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks
Mesop is a Python-based UI framework that allows users to build web applications. A class pollution vulnerability in Mesop prior to version 0.14.1 allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to...
CVE-2025-30358 Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks
Mesop is a Python-based UI framework that allows users to build web applications. A class pollution vulnerability in Mesop prior to version 0.14.1 allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to...
CVE-2024-11301
In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator...
CVE-2024-9415
CVE-2024-9415 affects transformeroptimus/superagi version 0.0.14, where a path traversal flaw in the file upload functionality allows uploading arbitrary files to the server, potentially leading to remote code execution or overwriting server files. The root cause is improper validation/sanitizati...
zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write
Summary In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in th...
CVE-2025-1785
The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdmnewfile' action. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite select file types outside of the originall...
Exploit for Path Traversal in Mholt Archiver
CVE-2024-0406 Proof of Concept PoC This repository contains...
MD5 Hash Collision Causes Overwriting of Papers with the Same Title, Leading to Data Loss
Description The ArxivReader class in LlamaIndex is responsible for searching for papers on ArXiv, downloading them, and processing them for AI model training. The workflow of ArxivReader is as follows: 1. The user searches for a specific topic on ArXiv, retrieving a list of relevant papers. impor...
Linux Distros Unpatched Vulnerability : CVE-2024-26712
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix addr error caused by page alignment In kasaninitregion, when kstart is n...
CVE-2025-21738
In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSIIOCTLSENDCOMMAND ioctl with outlen set to 0xd42, SCSI command set to ATA16 PASS-THROUGH, ATA command set to ATANOP, and...
CVE-2025-26356
CVE-2025-26356 affects Q-Free MaxTime