10593 matches found
CVE-2024-53677-Analysis
Анализ CVE-2024-53677 Этот репозиторий содержит документацию и лабораторные артефакты, подготовленные для анализа CVE-2024-53677 в Apache Struts. Обзор CVE-2024-53677 — это уязвимость в обработке загрузки файлов Apache Struts. Проблема возникает, когда метаданные, связанные с именем файла из...
CVE-2024-12209
CVE-2024-12209 WP Umbrella: Update Backup Restore & Monitoring = 2.17.0 - Unauthenticated Local File Inclusion Description The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename'...
CVE-2023-26255-6
Jira plugin STAGIL Navigation FileName Parameter Arbitrary File Read Vulnerability POC Script Usage as follows: Single URL Detection 1. Use the command line to detect a single URL, pass the URL parameter with -U 2. Observe the returned result; if it shows "is vulnerable!", then the vulnerability...
CVE-2026-100545
OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...
CVE-2026-100533
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the...
CVE-2026-100549 OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended...
CVE-2026-100545 OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...
CVE-2026-100545 OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...
CVE-2026-100545 OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...
EUVD-2026-87505
OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...
CVE-2026-100545
The OpenClaw (npm package openclaw) before version 2026.8.1 contains a vulnerability where it incorrectly enforces sender tool policies during session-memory filename generation . In affected versions, the generation process creates an embedded helper that retains tools even if the originating se...
CVE-2026-100533 OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the...
EUVD-2026-87517
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the...
CVE-2026-100533
OpenClaw versions prior to 2026.8.1 are vulnerable to a path traversal vulnerability within the tools.fs.workspaceOnly feature. The root cause is a Unicode filename fallback that can normalize validated parent directory components, allowing admitted requesters to exploit canonically equivalent si...
CLEANSTART-2026-RQ22332 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames
Security vulnerability affects the loki package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...
PT-2026-99170
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description A path traversal issue exists in the tools.fs.workspaceOnly feature. This occurs because Unicode filename fallback can normalize validated parent directory components, allowing admitted requester...
CVE-2026-100533: Improper Limitation of a Pathname to a Restricted Directory
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the...
CVE-2026-100545: Incorrect Authorization
OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...
GHSA-36H5-QG4P-Q2QF zbateson/mail-mime-parser has CRLF header injection via attachment filename
Impact A CRLF carriage-return / line-feed header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename. Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without...
zbateson/mail-mime-parser has CRLF header injection via attachment filename
Impact A CRLF carriage-return / line-feed header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename. Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without...