CVE-2024-54520

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to overwrite arbitrary files...

The vulnerability of the graphical interface of the microprogramming software for the FortiRecorder surveillance system allows a intruder to read arbitrary files.

The vulnerability of the graphical interface of the microprogramming software for the video surveillance system FortiRecorder is related to errors in processing the relative path to the directory. Exploiting this vulnerability allows a malicious actor to read arbitrary files by sending specially...

PT-2025-5290 · Apple · Macos Sonoma +3

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.7.3 macOS Sequoia versions prior to 15.3 macOS Sonoma versions prior to 14.7.3 Description: A path handling issue was addressed with improved validation, allowing an app to potentially read files outside of...

Node.js 18.x < 18.20.6 / 20.x < 20.18.2 / 22.x < 22.13.1 / 23.x < 23.6.1 Multiple Vulnerabilities (Tuesday, January 21, 2025 Security Releases).

The version of Node.js installed on the remote host is prior to 18.20.6, 20.18.2, 22.13.1, 23.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, January 21, 2025 Security Releases advisory. - A memory leak could occur when a remote peer abruptly closes the...

CVE-2024-54535

A path handling issue was addressed with improved logic. This issue is fixed in watchOS 11.1, visionOS 2.1, iOS 18.1 and iPadOS 18.1. An attacker with access to calendar data could also read reminders...

CVE-2024-54535

A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, watchOS 11.1. An attacker with access to calendar data could also read reminders...

CVE-2024-54535

A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, watchOS 11.1. An attacker with access to calendar data could also read reminders...

CVE-2024-54535

Affected product: Apple Vision Pro (calendar feature). Issue: a path handling vulnerability could allow an attacker with access to calendar data to read reminders. Root cause: path handling logic was reworked with improved validation. Affected OS updates and patches: watchOS 11.1, visionOS 2.1, i...

CVE-2024-54535

A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, watchOS 11.1. An attacker with access to calendar data could also read reminders...

The vulnerability of Websoft HCM’s automation software for HR processes stems from improper path handling, allowing attackers to perform arbitrary file operations outside of the directory.

The vulnerability of Websoft HCM’s automation software for HR processes arises from improper handling of paths during the loading of specially crafted files. Exploiting this vulnerability allows an attacker to perform arbitrary file operations outside the directory...

BIT-NODE-MIN-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment open-sourced by Node.js. Node.js suffers from a security vulnerability that stems from the permissions model's assumption that any path beginning with two backslashes has an ignorable four-character prefix, a subtle error th...

TCS BaNCS 安全漏洞

TCS BaNCS Tata Consultancy Services BaNCS is a core banking software suite from TCS Corporation. A security vulnerability exists in TCS BaNCS version 10, which stems from an incorrect operation of the parameter FilePath can result in file inclusion...

The vulnerability of the handle_api2_request() function in the Proxmox Virtual Environment platform’s interface, as well as the Proxmox Mail Gateway email protection mechanism, allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the handleapi2request function in the Proxmox Virtual Environment platform’s interface, along with the Proxmox Mail Gateway email protection mechanism, is related to improper external management of file names or paths when processing objects like “download” or “data-download”...

CVE-2024-54498

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to break out of its sandbox...

CVE-2024-54489

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. Running a mount command may unexpectedly execute arbitrary code...

CVE-2024-54498

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to break out of its sandbox...

CVE-2024-54489

CVE-2024-54489 describes a path handling issue that could allow arbitrary code execution when running a mount command. Affected: macOS Disk Utility across macOS Sonoma 14.7.2, macOS Ventura 13.7.2, and macOS Sequoia 15.2. Root cause: inadequate path validation; a fix with improved validation is i...

CVE-2024-54489

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. Running a mount command may unexpectedly execute arbitrary code...