36 matches found
CVE-2026-25264
Privilege escalation due to weak configuration during package extraction process...
CVE-2026-25264
Qualcomm Software Center is affected by an uncontrolled search path element vulnerability arising from weak configuration during its package extraction process. A local user with low privileges can exploit this to escalate privileges, with changed scope and high impact on confidentiality, integri...
CVE-2026-25264 Uncontrolled Search Path Element in Qualcomm Software Center
Privilege escalation due to weak configuration during package extraction process...
CVE-2026-25264 Uncontrolled Search Path Element in Qualcomm Software Center
Privilege escalation due to weak configuration during package extraction process...
PT-2026-96692
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Privilege escalation is possible due to a weak configuration during the package extraction process. Recommendations At the moment, there is no information about...
CVE-2026-25264: Uncontrolled Search Path Element
Privilege escalation due to weak configuration during package extraction process...
CVE-2026-81727
NLTK versions before 3.10.3 are affected by a filesystem containment bypass in the Downloader.download and Downloader.incr_download methods. An attacker with write access to a shared downloader directory can create hardlinks pointing to files outside the install root, which are then overwritten d...
PYSEC-2026-3729
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
UBUNTU-CVE-2026-63310
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
EUVD-2026-64335
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
CVE-2026-63310
...
CVE-2026-63310 NLTK before 3.9.3 Missing Post-Download Integrity Verification
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
Improper Validation of Integrity Check Value
Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the tarball extraction process when the integrity field is missing from the lockfile resolution. An attacker can introduce unauthorized...
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
Impact A crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. The root cause was the...
PT-2026-25321
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of...
CVE-2026-23940: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of...
Dart 路径遍历漏洞
Dart is an open-source programming language developed by Dartmouth. Dart has a path traversal vulnerability. This vulnerability arises when the pub client extracts packages, and files from malicious package archives may be extracted to locations outside of the PUBCACHE target directory, potential...
CVE-2025-65025: Improper Limitation of a Pathname to a Restricted Directory
esm.sh is a nobuild content delivery networkCDN for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths e.g.,...
BIT-JOOMLA-2022-23793 [20220301] - Core - Zip Slip within the Tar extractor
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path...