CVE-2025-30429

A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to break out of its sandbox...

CVE-2025-30429

CVE-2025-30429 : A path handling issue with insufficient validation allowed an app to break out of its sandbox. The vulnerability is addressed in Apple platforms: visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, and macOS Sonoma 14.7.5. T...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Apple iOS and Apple iPadOS that stems from improper path handling, which...

PT-2025-13996 · Apple · Macos Sonoma +6

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.7.5 iOS versions prior to 18.4 iPadOS versions prior to 18.4 macOS Sequoia versions prior to 15.4 macOS Sonoma versions prior to 14.7.5 visionOS versions prior to 2.4 Description: A path handling issue was...

Use of Incorrectly-Resolved Name or Reference

Overview Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference when parsing URIs in ProcessURI. An attacker can bypass security rules by sending URIs that starting with //. which lead to an incorrect setting of the REQUESTFILENAME. PoC go package main...

Origin Validation Error

Overview Flask-Cors is an A Flask extension adding a decorator for CORS support Affected versions of this package are vulnerable to Origin Validation Error due to the replacement of + characters with spaces in the unquoteplus function, when handling the request.path parameter. An attacker can cau...

CVE-2024-6844

A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquoteplus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path...

The vulnerability of the NTLM Hash component of the Windows operating system, which allows a hacker to perform spoofing attacks

The vulnerability of the NTLM Hash component of the Windows operating system is related to incorrect external management of file names or file paths. Exploiting this vulnerability allows a remote attacker to perform spoofing attacks...

USN-7349-1 rar vulnerabilities

It was discovered that RAR incorrectly handled certain paths. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to write arbitrary files outside of the targeted directory. CVE-2022-30333 It was discovered th...

The vulnerability of the PAN-OS operating system, related to incorrect external management of file names or file paths, allows attackers to compromise the confidentiality of protected information.

The vulnerability of the PAN-OS operating system is related to incorrect external management of file names or file paths. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality of protected information...

DEBIAN-CVE-2022-49242

In the Linux kernel, the following vulnerability has been resolved: ASoC: mxs: Fix error handling in mxssgtl5000probe This function only calls ofnodeput in the regular path. And it will cause refcount leak in error paths. For example, when codecnp is NULL, saifnp0 and saifnp1 are not NULL, it wil...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an incorrectly handled path in idxdcdevregister that results in resource consumption...

USN-7271-2 python-virtualenv vulnerability

USN-7271-1 fixed a vulnerability in virtualenv. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: It was discovered that virtualenv incorrectly handled paths when activating virtual environments. An attacker could possibly use this issue to execute...

USN-7271-1 python-virtualenv vulnerability

It was discovered that virtualenv incorrectly handled paths when activating virtual environments. An attacker could possibly use this issue to execute arbitrary code...

The vulnerability of Ivanti Connect Secure and Ivanti Policy Secure network access control tools lies in improper external management of file names or paths, allowing attackers to write arbitrary files.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to improper external management of file names or file paths. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

The vulnerabilities of the unzip() and untar() functions in the Deep Java Library (DJL) allow a hacker to write arbitrary files.

The vulnerability of the unzip and untar functions in the Deep Java Library DJL is related to improper external handling of file names or paths. Exploiting this vulnerability allows a malicious actor to write any files they desire remotely...

Security update for less

This update for less fixes the following issues: CVE-2024-32487: Fix a bug where mishandling of \n character in paths when LESSOPEN is set leads to OS command execution. bsc1222849 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate...

SUSE-SU-2025:20007-1 Security update for less

This update for less fixes the following issues: - CVE-2024-32487: Fix a bug where mishandling of \n character in paths when LESSOPEN is set leads to OS command execution. bsc1222849...

Privilege Escalation

net.snowflake:snowflake-jdbc is vulnerable to Privilege Escalation. The vulnerability is due to improper path handling due to an attacker with write access to a directory in %PATH% being able to escalate privileges when the EXTERNALBROWSER authentication method is used on Windows...

CVE-2025-23084

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory...