20 matches found
CVE-2026-53784
A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks...
SUSE CVE-2026-53784
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...
SUSE CVE-2026-70460
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...
ALPINE-CVE-2026-70460
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...
ALPINE-CVE-2026-53801
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...
CVE-2026-53801
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...
AZL-95798 CVE-2026-53793 affecting package rsync for versions less than 3.5.0-1
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...
ALPINE-CVE-2026-53784
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...
CVE-2026-70460 rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...
CVE-2026-53801
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...
CVE-2026-53793
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...
CVE-2026-53784
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...
CLSA-2026-1779694338 rsync: Fix of CVE-2026-29518
CVE-2026-29518: fix daemon-no-chroot sender TOCTOU symlink race by opening source files via securerelativeopen from module root...
EUVD-2023-43052
Malicious code in bioql PyPI...
UBUNTU-CVE-2023-39320
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules...
Google Go Code Injection Vulnerability
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google, Inc. A security vulnerability exists in Google Go version 1.21, which stems from a toolchain directive that can be used to execute scripts and binaries relative to the module root...
SUSE CVE-2023-39320
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules...
PT-2023-5127 · Go +2 · Go +2
Name of the Vulnerable Software and Affected Versions: Go versions 1.21 and later Description: The go.mod toolchain directive can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloade...
CVE-2006-6295
PHP remote file inclusion vulnerability in includes/mxcommon.php in the mxtinies 1.3.0 Module for MxBB Portal 1.06 allows remote attackers to execute arbitrary PHP code via a URL in the modulerootpath parameter...
mxBB Module calsnails 1.06 (mx_common.php) File Include Vulnerability
No description provided by source. mxBB calsnails module 1.06 Remote File Inclusion Vulnerability Bugfounder: bd0rk || SOH-Crew Website: www.soh-crew.it.tt Gr33tings: nukedx, DeeJay, TheJT, str0ke Mod-Download: http://www.mx-system.com/modules/mxpafiledb/dload.php?action=download&fileid=21...