SolarWinds Serv-U 15.5.3 Multiple Vulnerabilities

The version of SolarWinds Serv-U installed on the remote host is prior to 15.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsserv-u1553 advisory. - A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor wi...

Improper Input Validation

github.com/opencontainers/runc is vulnerable to improper input validation. The vulnerability is due to insufficient verification of the bind-mount source /dev/null, which allows an attacker to exploit it via arbitrary mount manipulation, leading to host information disclosure, denial of service,...

EUVD-2025-12231

Malicious code in bioql PyPI...

NewStart CGSL MAIN 6.06 : perl Multiple Vulnerabilities (NS-SA-2025-0211)

The remote NewStart CGSL host, running version MAIN 6.06, has perl packages installed that are affected by multiple vulnerabilities: - Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count...

Linux Distros Unpatched Vulnerability : CVE-2017-1002153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission. CVE-2017-1002153 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2021-43415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission...

CVE-2025-55282 aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migration

aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser inside PostgreSQL databases during a migration from an untrusted source server. By exploiting a lack of searchpath restriction, an attacke...

Linux Distros Unpatched Vulnerability : CVE-2020-1757

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final,...

Linux Distros Unpatched Vulnerability : CVE-2023-2454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - schemaelement defeats protective searchpath changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated...

K000152931: Multiple PostgreSQL vulnerabilities

Security Advisory Description CVE-2023-2455 Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other...

tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources

A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths...

The vulnerability of the cross-platform integrated development environment JetBrains Rider, related to bypassing the relative path, allows a malicious user to gain read, modify, or delete access to data.

The vulnerability of the cross-platform integrated software development environment JetBrains Rider is related to the exploitation of a relative path. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain read, modify, or delete access to data...

PYSEC-2025-118

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This...

Directory Traversal

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\. An attacker could read...

Consul L7 Intentions Vulnerable To URL Path Bypass

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules. This vulnerability, identified as CVE-2024-10005, is fixed in Consul Community Edition 1.20.1 and Consul Enterprise...

The vulnerability in the web interface of the Cisco Emergency Responder, a server for managing and monitoring emergency calls, allows an attacker to gain read, modify, or delete access to data.

The vulnerability in the web interface of the Cisco Emergency Responder server for emergency response management and monitoring involves bypassing a relative path. Exploiting this vulnerability allows an attacker operating remotely to gain read, modify, or delete access to data...

Huawei HarmonyOS/EMUI File Path Bypass Vulnerability

Huawei HarmonyOS is a distributed operating system developed independently by Huawei Technologies Co. Huawei EMUI is Huawei's emotional operating system based on Android. A file path bypass vulnerability exists in Huawei HarmonyOS/EMUI, which stems from a file path bypass vulnerability in email. ...

The vulnerability in the Roxy-WI web interface for managing Haproxy, Nginx, Apache, and Keepalived allows a attacker to access protected information.

The vulnerability of the getconfig function in the /app/modules/config/config.py file of the Roxy-WI web interface for controlling Haproxy, Nginx, Apache, and Keepalived servers is related to the possibility of bypassing the path. Exploiting this vulnerability can allow a malicious actor to gain...

CVE-2024-27318

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch adde...

ConnectWise ScreenConnect Security Breach

ConnectWise ScreenConnect is a self-hosted remote desktop software application from ConnectWise. A security vulnerability exists in ConnectWise ScreenConnect version 23.9.7 and prior versions, which stems from being affected by the use of an alternate path or channel to bypass authentication, and...