CVE-2025-13661

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required...

CVE-2025-13661

CVE-2025-13661 is a path-traversal vulnerability in Ivanti Endpoint Manager (prior to 2024 SU4 SR1). An authenticated remote attacker can write arbitrary files outside the intended directory, with user interaction required. Multiple sources (NVD/Red Hat EUVD, Nessus plugin, and related advisories...

CVE-2025-13661

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required...

PT-2025-50087

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU4 SR1 Description A path traversal issue exists in Ivanti Endpoint Manager. A remote authenticated attacker can write arbitrary files to locations outside the intended directory. User interactio...

The vulnerability of the nfs_direct_write_completion() function in the fs/nfs/direct.c module of the Linux file system support module allows a hacker to cause a service failure.

The vulnerability of the nfsdirectwritecompletion function in the fs/nfs/direct.c module of the Linux file system support module is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

Malicious code in tensor-fi-utils-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097848a520bc6a7316c011e97b306f4743b5498acdeccea54d5d4a0ab44bdebd The package tensor-fi-utils-core was found to contain malicious code. Source: ghsa-malware...

CVE-2025-66512 Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to circumvent the content security policy when a malicious user manages to trick a user it viewing an uploaded SVG outside...

CVE-2025-66512

Nextcloud Server and Server Enterprise before 31.0.12 and 32.0.3 have a missing sanitization that can be exploited to bypass content security policy when a user is tricked into viewing a crafted SVG outside the Nextcloud UI, enabling cross-site scripting. Fedora advisories FEDORA-2025-86c0829159 ...

MAL-2025-192317 Malicious code in tailwindcss-setfont (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f910baae4eb0176c7c1c4b6bde6db28967b1f8674784e8953fe7abb47d7730a4 The package tailwindcss-setfont was found to contain malicious code. Source: ghsa-malware...

The vulnerability of the vfs_streams_xattr module in the Samba networking software package allows a hacker to gain access to confidential information.

The vulnerability of the vfsstreamsxattr module in the Samba networking software package is related to reading data outside of the allowed range. Exploiting this vulnerability could allow an attacker to gain access to confidential information...

MAL-2025-192298 Malicious code in elf-stats-candlelit-marshmallow-663 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8cf5bd84066a57d6f168967adc62dd26c49c4095817e6db922dc357f63f824e The package elf-stats-candlelit-marshmallow-663 was found to contain malicious code. Source: ghsa-malware...

BIT-NGINX-AGENT-2024-7634 NGINX Agent Vulnerability

NGINX Agent's "configdirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory...

CVE-2025-13879

Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. This vulnerability allows an authenticated user with administrator privileges to list directories other than those to which the have authorized access using the 'directory' parameter in '/mod/ajax.php?action=sections/list/list'.For...

Directory Traversal

github.com/argoproj/argo-workflows is vulnerable to Directory Traversal. The vulnerability is due to improper validation of archive entry paths during artifact extraction, which allows an attacker to craft malicious archive files that write arbitrary files outside the intended extraction director...

Malicious code in react-animated-glow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c046e67371a339da9e3c12d108f16059eb5eed933f54d51b3429a77effdcdf8a The package react-animated-glow was found to contain malicious code. Source: ghsa-malware...

Malicious code in cyber-fca (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b577f3dcb8f7ebe36e69f65a8b605a23ff2dbdb7d896e78bc20f1880331a238c The package cyber-fca was found to contain malicious code. Source: ghsa-malware c7c387785610633bef06443bfd2ecd4a274d3d1265e22822b04579fae216ba2c Any...

CVE-2025-66295

Grav CVE-2025-66295 describes a path traversal/write vulnerability in Grav’s Admin UI: before 1.8.0-beta.27, a user-creation flow could cause an account YAML file to be written outside the intended user/accounts/ directory when the username contains traversal sequences (e.g., ../../Nijat). The wr...

BIT-FLUENT-BIT-2025-12972 CVE-2025-12972

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

CVE-2025-12638

Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.getfile function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall method without the security-critical filter='data' parameter. Although Keras attempts...

CVE-2025-12638 Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file()

Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.getfile function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall method without the security-critical filter='data' parameter. Although Keras attempts...