DNSCrypt-proxy Security Vulnerability

DNSCrypt-proxy is a DNS proxy for the DNSCrypt project. A security vulnerability exists in DNSCrypt-proxy versions v2.0.0alpha9 through v2.1.5 that stems from improper privilege management. An attacker can exploit the vulnerability to elevate privileges to root by overwriting the binary...

PT-2024-27083 · Unknown · Adguardhome

Name of the Vulnerable Software and Affected Versions: AdGuardHome versions 0.93 through latest Description: The issue allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary. This is a privilege escalation vulnerability in AdGuardHome. Recommendations: For...

CVE-2024-36586

An issue in AdGuardHome v0.93 to latest allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary...

CVE-2024-33606

An attacker could retrieve sensitive files medical images as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User interaction is required to exploit this vulnerability...

CVE-2024-2624 Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui

A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the @router.get"/switchpersonalpath" endpoint in ./lollms-webui/lollmscore/lollms/server/endpoints/lollmsuser.py. The vulnerability arises due to insufficient sanitization...

PT-2025-30434

Name of the Vulnerable Software and Affected Versions ONNX version 1.17.0 Description A path traversal issue exists in the onnx.external data helper.save external data function. This allows attackers to overwrite arbitrary files by providing crafted external data.location paths containing travers...

SUSE-SU-2024:1854-1 Security update for git

This update for git fixes the following issues: - CVE-2024-32002: Fixed case confusion with recursive clones on case-insensitive filesystems that support symbolic links bsc1224168 - CVE-2024-32004: Fixed arbitrary code execution during local clones bsc1224170 - CVE-2024-32020: Fixed file...

CVE-2024-25975

The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is...

SUSE CVE-2023-52871

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: llcc: Handle a second device without data corruption Usually there is only one llcc device. But if there were a second, even a failed probe call would modify the global drvdata pointer. So check if drvdata is valid...

HAWKI 跨站脚本漏洞

HAWKI is a university teaching interface based on the OpenAI API by the HAWK Digital Environments team in Germany. HAWKI has a security vulnerability that stems from a path traversal vulnerability due to not properly filtering POST parameters. An attacker can exploit the vulnerability to overwrit...

SUSE-SU-2024:1807-1 Security update for git

This update for git fixes the following issues: - CVE-2024-32002: Fixed recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion bsc1224168. - CVE-2024-32004: Fixed arbitrary code execution during local clones bsc1224170. - CVE-2024-32020: Fix...

CVE-2024-27946

CVE-2024-27946 affects Siemens RUGGEDCOM CROSSBOW (all versions before V5.5). The issue is a path traversal/file download weakness that lets an attacker overwrite arbitrary files in the installation directory by supplying a target filename, given the attacker has the required privileges. Affected...

CVE-2024-27946

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.5. Downloading files overwrites files with the same name in the installation directory of the affected systems. The filename for the target file can be specified, thus arbitrary files can be overwritten by an attacker with...

RHEL 6 : pcp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - pcp: Local privilege escalation in pcp spec file %post section CVE-2019-3695 - A Improper Limitation of a...

CVE-2024-34033 Path Traversal vulnerability in Delta Electronics DIAEnergie

Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten...

Zscaler Client Connector 安全漏洞

Zscaler Client Connector is an application from zscaler. An application that is installed on a device to ensure that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A...

Zscaler Client Connector 安全漏洞

Zscaler Client Connector is an application from zscaler. An application that is installed on a device to ensure that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A...

Archiver Path Traversal vulnerability

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privilege...

CVE-2024-0406

CVE-2024-0406 concerns the mholt/archiver package. The connected Nessus/SUSE entries confirm a path-traversal flaw in tar unpacking that can cause writing to restricted files or directories when extracting archives. The remediation path shown in the connected docs includes upgrading the affected ...

CVE-2024-30254 Directory traversal allowing overwriting arbitrary files

MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files if the attacker can make the victim either run the language server within a specific crafted project or mesonlsp --full. Version 4.1.4...