CVE-2024-54535

Affected product: Apple Vision Pro (calendar feature). Issue: a path handling vulnerability could allow an attacker with access to calendar data to read reminders. Root cause: path handling logic was reworked with improved validation. Affected OS updates and patches: watchOS 11.1, visionOS 2.1, i...

CVE-2024-54535

A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, watchOS 11.1. An attacker with access to calendar data could also read reminders...

CVE-2024-54535

A path handling issue was addressed with improved logic. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1, watchOS 11.1. An attacker with access to calendar data could also read reminders...

The vulnerability of Websoft HCM’s automation software for HR processes stems from improper path handling, allowing attackers to perform arbitrary file operations outside of the directory.

The vulnerability of Websoft HCM’s automation software for HR processes arises from improper handling of paths during the loading of specially crafted files. Exploiting this vulnerability allows an attacker to perform arbitrary file operations outside the directory...

BIT-NODE-MIN-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment open-sourced by Node.js. Node.js suffers from a security vulnerability that stems from the permissions model's assumption that any path beginning with two backslashes has an ignorable four-character prefix, a subtle error th...

TCS BaNCS 安全漏洞

TCS BaNCS Tata Consultancy Services BaNCS is a core banking software suite from TCS Corporation. A security vulnerability exists in TCS BaNCS version 10, which stems from an incorrect operation of the parameter FilePath can result in file inclusion...

The vulnerability of the handle_api2_request() function in the Proxmox Virtual Environment platform’s interface, as well as the Proxmox Mail Gateway email protection mechanism, allows a perpetrator to gain access to read, modify, or delete data.

The vulnerability of the handleapi2request function in the Proxmox Virtual Environment platform’s interface, along with the Proxmox Mail Gateway email protection mechanism, is related to improper external management of file names or paths when processing objects like “download” or “data-download”...

CVE-2024-54498

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to break out of its sandbox...

CVE-2024-54489

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. Running a mount command may unexpectedly execute arbitrary code...

CVE-2024-54498

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to break out of its sandbox...

CVE-2024-54489

CVE-2024-54489 describes a path handling issue that could allow arbitrary code execution when running a mount command. Affected: macOS Disk Utility across macOS Sonoma 14.7.2, macOS Ventura 13.7.2, and macOS Sequoia 15.2. Root cause: inadequate path validation; a fix with improved validation is i...

CVE-2024-54489

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. Running a mount command may unexpectedly execute arbitrary code...

CVE-2024-54498

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to break out of its sandbox...

CVE-2024-54498

CVE-2024-54498 affects macOS Sequoia 15.2, macOS Ventura 13.7.2, and macOS Sonoma 14.7.2. The underlying issue is a path handling problem involving insufficient validation, which could allow an app to break out of its sandbox. The publicly documented impact is sandbox escape; no exploit details a...

CVE-2024-54498

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to break out of its sandbox...

PT-2024-36354

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Sequoia 15.2 macOS versions prior to Ventura 13.7.2 macOS versions prior to Sonoma 14.7.2 Description: A path handling issue was addressed with improved validation. Running a mount command may unexpectedly execute...

haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers

HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server...

The vulnerability of the Portal for ArcGIS web portal, related to improper external management of file names or paths, allows a perpetrator to disclose protected information.

The vulnerability of the Portal for ArcGIS is related to improper external management of the file name or path. Exploiting this vulnerability can allow a malicious actor to disclose protected information through a specially created web page...