23268 matches found
EulerOS Virtualization 2.12.0 : sed (EulerOS-SA-2026-2804)
According to the versions of the sed package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic...
ALSA-2026:42739 Important: acl security update
Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fixes: acl: Symlink traversal privilege escalation via libacl function...
Oracle Linux 9 : acl (ELSA-2026-42736)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42736 advisory. 2.4.0-1 - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions RHEL-186111 -...
acl security update
2.4.0-1 - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions RHEL-186111 - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl RHEL-186216...
RHEL 9 : acl (RHSA-2026:42736)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42736 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain t...
RHEL 10 : acl (RHSA-2026:42739)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42739 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain...
ALSA-2026:42736 Important: acl security update
Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fixes: acl: Symlink traversal privilege escalation via libacl function...
acl security update
2.4.0-1 - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions RHEL-186106 - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl RHEL-186207...
Important: acl security update
Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fixes: acl: Symlink traversal privilege escalation via libacl function...
EulerOS Virtualization 2.12.0 : util-linux (EulerOS-SA-2026-2810)
According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check- Time-of-Use vulnerabilit...
Symlink Attack
Overview Affected versions of this package are vulnerable to Symlink Attack via the chmod, chown, or similar path-based system calls. An attacker can modify permissions, ownership, or timestamps of files outside the intended directory by exploiting symlink races. This is only exploitable if the...
EUVD-2026-42272
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope...
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...
GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
Summary A scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, and the application's own database via the upload failure-cleanup path. This is an incomplete fix of CVE-2026-54094: the v2.63.14 ScopedFs containme...
GHSA-FMM7-X4GX-8JHR File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
Summary A scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, and the application's own database via the upload failure-cleanup path. This is an incomplete fix of CVE-2026-54094: the v2.63.14 ScopedFs containme...
CVE-2026-44509
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason: This candidate is a duplicate of CVE-2026-43619. Notes: All CVE users should reference CVE-2026-43619 instead of this candidate...
EUVD-2026-46100
Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open calls missed races in other path based system calls like chmod and chown. For rsync daemons with "use chroot = no" this...
