Werkzeug 安全漏洞

Werkzeug is a comprehensive WSGI web application library open-sourced by Pallets. A security vulnerability exists in Werkzeug versions prior to 3.1.4, which stems from improper handling of Windows device names by the safejoin function, which may result in file read hangs...

CVE-2025-66221: Improper Handling of Windows Device Names

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safejoin function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory...

The vulnerability of the Device Association Broker service for Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Device Association Broker service for Windows operating systems lies in the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2025-35967

Out-of-bounds read for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This...

CVE-2025-55677

Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

CVE-2025-50174

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

CVE-2025-55677 Windows Device Association Broker Service Elevation of Privilege Vulnerability

...

EUVD-2025-34429

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

Windows Device Association Broker Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

PT-2025-41999

Name of the Vulnerable Software and Affected Versions Windows versions affected versions not specified Description A use after free condition exists in the Windows Device Association Broker service. This allows an authorized attacker to elevate privileges locally. A use-after-free occurs when a...

CVE-2025-55677: Untrusted Pointer Dereference

Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

CVE-2025-50174: Use After Free

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

EUVD-2020-2301

Malware in sbrugna...

EUVD-2024-18016

Malicious code in bioql PyPI...

EUVD-2022-38148

Malicious code in bioql PyPI...

BIT-NODE-MIN-2025-27210

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API...

BIT-NODE-2025-27210

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API...

CVE-2025-27210

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API...

CVE-2025-27210

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API...

CVE-2025-27210

Node.js on Windows is affected by a path.join handling vulnerability affecting drive names (CON, PRN, AUX). CVE-2025-27210 notes an incomplete fix for CVE-2025-23084, indicating Windows device-name handling was not treated as special, causing a path that should be relative to be interpreted with ...