289 matches found
UBUNTU-CVE-2025-2817
Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file...
CVE-2025-29819
External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally...
CVE-2025-3033: External Control of File Name or Path
After selecting a malicious Windows .url shortcut from the local filesystem, an unexpected file could be uploaded. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 137 and Thunderbird 137...
GHSA-75PX-35P4-QQ6H Aim External Control of File Name or Path vulnerability
A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the tarfile.extractall function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control repo.path and runhash to bypass directory existence checks and...
PT-2025-12166
Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.19.3 Description A vulnerability allows an attacker to exploit the tarfile.extractall function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control...
CVE-2025-29930: External Control of File Name or Path
imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $GET'seoOp' parameter is manipulated to include malicious input e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php, the application could allow an attacker to rea...
The vulnerability of the NTLM protocol implementation in Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the NTLM protocol implemented by the Windows operating system is related to external file name or path control. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Fortinet FortiClientMAC 安全漏洞
Fortinet FortiClientMAC is a U.S. fly tower Fortinet company based on macOS platform security tools. A code execution vulnerability exists in Fortinet FortiClientMAC that originates from an external control of a file name or path, which can be exploited by a local attacker to execute arbitrary co...
CVE-2025-24996
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...
CVE-2025-24996
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...
CVE-2025-24054
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...
CVE-2025-25478: External Control of File Name or Path
The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password...
Pebble 安全漏洞
Pebble is a Java template engine open-sourced by PebbleTemplates. A security vulnerability exists in Pebble that stems from easy external control of file names or paths via include tags, which allows an elevated-privilege attacker to access sensitive local files by crafting malicious notification...
CVE-2024-4230: External Control of File Name or Path
External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure,...
PlexTrac 安全漏洞
PlexTrac is a penetration test reporting and management platform from the US-based PlexTrac, Inc. A security vulnerability exists in PlexTrac versions prior to 1.61.3 through 2.8.1, which stems from the presence of a filename or path external control vulnerability that allows an attacker to achie...
Multiple vulnerabilities in Edgecross Basic Software for Windows
Overview Edgecross Basic Software for Windows provided by Edgecross Consortium contains multiple vulnerabilities listed below. Incorrect default permissions CWE-276 - CVE-2024-4229 External control of file name or path CWE-73 - CVE-2024-4230 Edgecross Consortium reported these vulnerabilities to...
CVE-2024-49367
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at /api/configs to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue...
Nginx UI 安全漏洞
Nginx UI is a WebUI for Nginx by Jacky's personal developer. A security vulnerability exists in Nginx UI versions prior to 2.0.0-beta.36, which stems from the fact that its log path is controlled, allowing an attacker to read the contents of directories and files on the server in conjunction with...