OpenClaw: macOS optional allowlist basename matching could bypass path-based policy

Summary On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries for example echo as trusted command matches. This could allow a same-name local binary for example ./echo to run without approval under security=allowlist + ask=on-miss. Scope / Precondition...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the exec approval mode on macOS node-hosts when basename-only allowlist entries are configured. An attacker can execute unauthorized local binaries by creating ...

PT-2026-25111

Summary On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries for example echo as trusted command matches. This could allow a same-name local binary for example ./echo to run without approval under security=allowlist + ask=on-miss. Scope / Precondition...

PT-2026-26397

Summary On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries for example echo as trusted command matches. This could allow a same-name local binary for example ./echo to run without approval under security=allowlist + ask=on-miss. Scope / Precondition...

check-jsonschema default caching for remote schemas allows for cache confusion

Impact The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attacker can get a user to run check-jsonschema against a malicious schema URL,...

DEBIAN-CVE-2023-6246

A heap-based buffer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name the basename of...

DEBIAN-CVE-2022-37290

GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive...

GNOME Nautilus code-related vulnerabilities

GNOME Nautilus is a file manager for use in the GNOME desktop environment. A security vulnerability exists in GNOME Nautilus version 42.2, which allows an attacker to implement a null pointer reference and cause the getbasename application to crash by pasting a ZIP archive...

MoinMoin Multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with 1 the rename parameter or 2 the drawing parameter aka the basename variable...

CVE-2009-0260

Multiple cross-site scripting XSS vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with 1 the rename parameter or 2 the drawing parameter aka the basename variable...

GNU C Library Denial of Service Vulnerability (CNVD-2018-05199)

The GNU C Library is an open-source, free, easy-to-download C compiler released under the LGPL license. A denial of service vulnerability exists in GNU C Library 2.26 in string/basename.c in basename. An attacker can exploit this vulnerability with specially crafted parameters to cause a denial o...

Arbitrary File Read Vulnerability in the Basename Function of the SDCMS errorcontroller.php Page

SDcms is a content management system developed by Suzhou Fireworks Network Technology Co. SDCMS errorcontroller.php page basename function has an arbitrary file reading vulnerability, an attacker can use the vulnerability to read arbitrary files to obtain sensitive information...

Internet Bug Bounty: Invalid memory access in php_basename function

https://bugs.php.net/bug.php?id=73295...

Updated busybox packages fix CVE-2014-9645

Updated busybox packages fix security vulnerability: The modprobe command in busybox before 1.23.0 uses the basename of the module argument as the module to load, allowing arbitrary modules, even when some kernel subsystems try to prevent this CVE-2014-9645...

WS-2014-0011

Unprivileged arbitrary module load via basename abuse...

justVisual 2.0 Local File Inclusion

justVisual 2.0 index.php = LFI Vulnerability +Title: justVisual 2.0 index.php Local File Vulnerability +Version: 2.0 +License: http://www.gnu.org/copyleft/gpl.html +Download: http://fh54.de/justVisual/packages/justVisual2.zip +Risk: Medium +Local: Yes -Remote: No !Author: eidelweiss !Contact:...

Mobilelib Gold v3 Local File Disclosure Vulnerability

No description provided by source. || || | || o,7 || . o7 || q||| o\, : / / . /QQQQQQQQQQQQQQQQQQQ\ /QQQ/\QQQ\ /QQQQQ/ \QQQQQQ\ /QQQQ/ QQQQ\ /QQQQ/ \QQQQ\ |QQQQ/ By Qabandi \QQQQ| |QQQQ| |QQQQ| |QQQQ| From Kuwait, PEACE... |QQQQ| |QQQQ| |QQQQ| |QQQQ\ iqaahotmail.fr /QQQQ| \QQQQ\ /QQQQ/ \QQQQ...

Mobilelib Gold 3.0 - Local File Disclosure

|| || | || o,7 || . o7 || q||| o\, : / / . /QQQQQQQQQQQQQQQQQQQ\ /QQQ/\QQQ\ /QQQQQ/ \QQQQQQ\ /QQQQ/ QQQQ\ /QQQQ/ \QQQQ\ |QQQQ/ By Qabandi \QQQQ| |QQQQ| |QQQQ| |QQQQ| From Kuwait, PEACE... |QQQQ| |QQQQ| |QQQQ| |QQQQ\ iqaahotmail.fr /QQQQ| \QQQQ\ /QQQQ/ \QQQQ\ /QQ\QQQQ/ \QQQQ\ \QQQQQQQ/ \QQQQQ...

CVE-2009-0260

Multiple cross-site scripting XSS vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with 1 the rename parameter or 2 the drawing parameter aka the basename variable...

IBM Lotus Domino 7.0.2FP1 IMAP4 Server LSUB Command Exploit

No description provided by source. !perl "IBM Lotus Domino" IMAP4 Server 'LSUB' Command Exploit Author: Manuel Santamarina Suarez e-Mail: [email protected] use IO::Socket; use File::Basename; destination TCP port $port = 143; SE handler...