Advisory ROSA-SA-2026-3135

Software: git 2.43.5 OS: ROSA Virtualization 2.1 unaffected versions = git-2.43.5-3.rv3 affected versions git-2.43.5-3.rv3 CVE-ID: CVE-2023-25652 BDU-ID: 2023-03859 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Git distributed version control system is related to flaws in the directory path na...

The vulnerability of the commonprefix() function in the pip module of the Python programming language allows a malicious actor to gain access to add and modify any arbitrary files.

The vulnerability of the commonprefix function in the pip module of the Python programming language is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow a malicious actor to gain access to add and modify any files they desire...

The vulnerability of the KLogic SCADA system “KASKAD”’s virtual controller allows a intruder to execute arbitrary code.

The vulnerability of the KLogic SCADA system “KASKA” lies in an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

A vulnerability in the web interface for managing and interacting with the Cassandra database allows a malicious actor to read arbitrary files, due to an incorrect name limit on the directory path.

The vulnerability of the Rack::Protection web interface for managing and interacting with the Cassandra Web database lies in an incorrect restriction on the path name to the directory. Exploiting this vulnerability allows a malicious actor to read arbitrary files...

The vulnerability of the npm package manager lies in the incorrect path name restrictions, which allow attackers to write arbitrary files.

The vulnerability of the npm package manager is related to incorrect restrictions on path names in the catalog. Exploiting this vulnerability allows a remote attacker to write arbitrary files...

The vulnerability lies in the scripts for fetching/binary-fetcher/src/index.ts and resolving/resolver-base/src/index.ts of the package manager pnpm, allowing a hacker to write arbitrary files.

The vulnerability in the fetch/binary-fetcher/src/index.ts and resolve/resolver-base/src/index.ts scripts of the package manager pnpm is related to an incorrect path name limitation. Exploiting this vulnerability could allow a remote attacker to write arbitrary files...

ROS-20260129-73-0058

Vulnerability in mariadb11.8 related to incorrect path name restriction to a restricted directory. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of Qfiling’s automatic file organization and sorting software arises from incorrect path name restrictions for the directory. This allows attackers to gain unauthorized access to protected information.

The vulnerability of Qfiling’s automatic file organization and sorting software is related to incorrect restrictions on path names to the catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the mariadb-dump component of the MariaDB database management system allows a hacker to execute arbitrary code.

The vulnerability of the mariadb-dump component of the MariaDB database management system is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Containerization security vulnerabilities

Containerization is an open-source Swift container package developed by Apple. There is a security vulnerability in Containerization, which stems from the lack of path name validation before extracting archived members. This vulnerability may allow files to be extracted to any writable location b...

WordPress plugin Anona: Path traversal vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

MiracleLinux 8 : curl-7.61.1-18.el8.1 (AXSA:2021-2446:04)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2446:04 advisory. curl: Content not matching hash in Metalink is not being discarded CVE-2021-22922 curl: Metalink download sends credentials CVE-2021-22923 curl: Bad...

The vulnerability of the Node.js software platform, related to incorrect restrictions on path names for directories with restricted access, allows attackers to compromise the system.

The vulnerability of the Node.js software platform is related to incorrect restrictions on path names for directories with restricted access. Exploiting this vulnerability can allow an attacker to compromise the system...

The vulnerability of the Windows Shell component in Windows operating systems allows attackers to perform spoofing attacks.

The vulnerability of the Windows Shell component in Windows operating systems is related to incorrect path name restrictions. Exploiting this vulnerability can allow attackers to perform spoofing attacks...

The vulnerability of the MICROSENS NMP Web+ network management platform lies in the incorrect limitation of the path name to the restricted directory, allowing an attacker to execute arbitrary codes.

The vulnerability of the MICROSENS NMP Web+ network management platform lies in incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of Wangshen SecGate 3600 lies in the incorrect restriction of the path name to the restricted access catalog, allowing attackers to bypass existing security restrictions.

The vulnerability of Wangshen SecGate 3600 relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

The vulnerability of the SolarWinds Serv-U File Server file server lies in the incorrect path name limitation for the directory, allowing a hacker to execute arbitrary code.

The vulnerability of the SolarWinds Serv-U File Server file server is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the microprogrammed software of the GL.iNet MT6000, A1300, X300B, AX1800, AXT1800, MT2500, MT3000, X3000, XE3000, XE300, E750, X750, SFT1200, AR300M, AR300M16, AR750, AR750S, B1300, MT1300, MT300N-V2, AP1300, B2200, MV1000, MV1000W, USB150, SF1200, N300, S1300 lies in the incorrect limitation on the path name to the restricted access directory. This allows attackers to execute arbitrary commands.

The vulnerability of the microprogrammed software of the GL.iNet MT6000, A1300, X300B, AX1800, AXT1800, MT2500, MT3000, X3000, XE3000, XE300, E750, X750, SFT1200, AR300M, AR300M16, AR750, AR750S, B1300, MT1300, MT300N-V2, AP1300, B2200, MV1000, MV1000W, USB150, SF1200, N300, S1300 lies in the...

The vulnerability of the Docker Compose tool for managing multi-container applications arises from incorrect path name restrictions for restricted access directories. This allows attackers to re-record arbitrary files.

The vulnerability of the Docker Compose tool for managing multi-container applications is related to incorrect path name restrictions for restricted access directories. Exploiting this vulnerability could allow a malicious actor to re-record arbitrary files...

The vulnerability of the VM_BIND component of the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the VMBIND component of the Linux operating system’s kernel is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a attacker to cause a service failure...