Apple macOS 安全漏洞

Apple macOS is a proprietary operating system developed by the American company Apple for Mac computers. Vulnerabilities exist in versions of Apple macOS such as Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4. These vulnerabilities stem from improper handling of symbolic links, which may allow...

OPENSUSE-SU-2026:20273-1 Security update for 7zip

This update for 7zip fixes the following issues: - Update to 25.01 boo1249130 The code for handling symbolic links has been changed to provide greater security when extracting files from archives Command line switch -snld20 can be used to bypass default security checks when creating symbolic link...

USN-7984-1 pagure vulnerabilities

Thomas Chauchefoin discovered that Pagure incorrectly handled symbolic links in Git repositories. A remote attacker could possibly use this issue to cause Pagure to expose files outside the intended repository boundaries. CVE-2024-4981 Thomas Chauchefoin discovered that Pagure did not properly...

CVE-2025-8110

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code...

EUVD-2025-202425

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code...

Argo Workflows 操作系统命令注入漏洞

Argo Workflows is an open source container-native workflow engine for Kubernetes from the Argo project. An operating system command injection vulnerability exists in Argo Workflows versions 3.6.13 and earlier and versions 3.7.0 through 3.7.4, which stems from improper handling of symbolic links a...

PT-2025-50327

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.0 with PutContents API enabled. Description Gogs contains a path traversal vulnerability in the PutContents API, allowing authenticated attackers to overwrite files outside the repository and achieve remote code...

CVE-2025-8917 Path Traversal Leading to Remote Code Execution in allegroai/clearml

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the safeextract function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical fil...

EUVD-2025-21253

Malicious code in bioql PyPI...

EUVD-2024-34586

Malicious code in bioql PyPI...

CVE-2025-5468

Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 Fix deployed on 02-Aug-2025 allows a local authenticated attacker to re...

The vulnerability in the software for automatic checking of updates for the Microsoft Edge Update browser lies in the improper handling of symbolic links before accessing the file. This allows a malicious actor to elevate their privileges to a system level.

The vulnerability in the software for automatic checking of updates for the Microsoft Edge Update browser is related to an incorrect definition of symbolic links before accessing the file. Exploiting this vulnerability could allow a malicious individual to elevate their privileges to a system lev...

EulerOS 2.0 SP13 : rsync (EulerOS-SA-2025-1325)

According to the versions of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum lengt...

PT-2025-13560 · Futurenet · Futurenet Nxr Series

Name of the Vulnerable Software and Affected Versions: FutureNet NXR series, VXR series and WXR series routers affected versions not specified Description: The issue exists due to improper handling of symbolic link files. An attacker can exploit this by attaching an external storage containing...

The vulnerability of the Storage component in Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Storage component in Windows operating systems is related to errors in handling symbolic links. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2025-24832

Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM Linux before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM Linux before build 1.9.1.892, Acronis Backup extension f...

PT-2025-9037 · Acronis · Acronis Backup Plugin For Cpanel & Whm +1

Name of the Vulnerable Software and Affected Versions: Acronis Backup plugin for cPanel & WHM Linux versions 1.8.4.866 and earlier Acronis Backup plugin for cPanel & WHM Linux versions 1.9.1.892 and earlier Acronis Backup extension for Plesk Linux versions 1.8.7.615 and earlier Description: The...

CLSA-2025-1737990875 rsync: Fix of 2 CVEs

CVE-2024-12747: fix race condition during symbolic links handling - CVE-2024-12086: fix infoleak when connect to malicious server...

USN-7206-1: rsync vulnerabilities

Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync did not properly handle checksum lengths. An attacker could use this issue to execute arbitrary code. CVE-2024-12084 Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync compared checksums with...

AZL-55679 CVE-2024-12747 affecting package rsync for versions less than 3.4.1-1

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass...