WordPress plugin Health Check & Troubleshooting – security vulnerabilities

...

MAL-2025-192576 Malicious code in sd-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 429e5a82bf0260fda2c531fb7909cf8b8417e424119df889ee7bad0ca4b439c2 The package sd-security was found to contain malicious code. Source: ghsa-malware e295e65302840407a5f64ae51ff2616121573aa518cd29d40198edf692c604de An...

rsync: Path traversal vulnerability in rsync

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...

Path Traversal

Grav is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of the username path during user creation, where Grav writes the account YAML file to an unintended location outside user/accounts/ when a username contains path traversal sequences, allowing attackers to...

Malicious code in kashif-mallah-fca (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c3015dc78458d21da40c01cf159c54f0298cd4ce7ea2604eecc18a7ea906cdd The package kashif-mallah-fca was found to contain malicious code. Source: ghsa-malware...

Malicious code in sd-pay-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7543455a42022174e965eac8f842494f5ad7eb1e0755dfd01035529d63d7a5ff The package sd-pay-ts was found to contain malicious code. Source: ghsa-malware c21a3fe3b0a1df838e4d8b768b5dcc2cf3831bea34c8527fd9e8493ab480bdd7 Any...

CVE-2020-36893 Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability

Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system...

CVE-2025-13661

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required...

Malicious code in rum-events-format (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f6a17ba09614cd69d096859385577957b2737a3dce290dda9712c51fd7179c5 The package rum-events-format was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192405 Malicious code in confluent-kafka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80f8f3691acc10147a767bd08facab31e59a8acfb8d38c89df1400e263cc6f8f The package confluent-kafka was found to contain malicious code. Source: ghsa-malware 135e8cf2cd5582b8ed8562c5f5ccfd1cf7265319ad340463b750b75e341858e...

PT-2025-50514

Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system...

EUVD-2025-202288

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required...

CVE-2025-67487

Static Web Server SWS is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links symlinks which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent symlinks from escaping th...

CVE-2025-13661

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required...

CVE-2025-13661

CVE-2025-13661 is a path-traversal vulnerability in Ivanti Endpoint Manager (prior to 2024 SU4 SR1). An authenticated remote attacker can write arbitrary files outside the intended directory, with user interaction required. Multiple sources (NVD/Red Hat EUVD, Nessus plugin, and related advisories...

CVE-2025-13661

Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required...

Linux fs/nfs/direct.c Direct Write Buffer Overflow DoS

The vulnerability of the nfsdirectwritecompletion function in the fs/nfs/direct.c module of the Linux file system support module is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2025-50087

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU4 SR1 Description A path traversal issue exists in Ivanti Endpoint Manager. A remote authenticated attacker can write arbitrary files to locations outside the intended directory. User interactio...

Malicious code in tensor-fi-utils-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097848a520bc6a7316c011e97b306f4743b5498acdeccea54d5d4a0ab44bdebd The package tensor-fi-utils-core was found to contain malicious code. Source: ghsa-malware...

Fluent Bit out_file Path Traversal

The vulnerability of the outfile plugin of the Fluent Bit logging and processing tool is related to an incorrect restriction on the path name for the directory. Exploiting this vulnerability could allow a malicious actor to write any file outside of the target directory...