ROS-20261110-73-0083

The vulnerability in the Visual Studio Code source code editor is related to improper validation of directory path names. Exploitation of this vulnerability could allow a remote attacker to bypass existing security mechanisms...

hwk-fr ACF Extended path traversal vulnerability

The hwk-fr ACF Extended versions 0.9.2.7 and earlier contain a path traversal vulnerability. This vulnerability stems from improper restriction of path names and makes them susceptible to path traversal attacks...

GHSA-866W-XMHQ-WJ7X SvelteKit: Prototype pollution in file input deletion path in remote-function forms

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...

ColdFusion Path Traversal

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on path names in the directory structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20260713-73-0025

The vulnerability in Python-Relenv relates to incorrect path name restrictions for the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

[slackware-security] proftpd

New proftpd packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/proftpd-1.3.9c-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues: ExecEnviron values not passed due to...

CVE-2026-28705 Gitea repository dumps write release assets using unsafe path names

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths...

CVE-2026-8362

A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long URL path starting with /woshome...

Rockwell Automation FactoryTalk View Machine Edition Path Traversal

The vulnerability of the software for creating and managing graphical user interfaces on Rockwell Automation FactoryTalk View Machine Edition industrial devices is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a...

EUVD-2014-3655

Malware in sbrugna...

EUVD-2025-28380

Malicious code in bioql PyPI...

CVE-2025-50978

In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...

CVE-2025-50978

In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...

CVE-2025-50978

In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...

CVE-2025-50978

In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...

CVE-2025-50978

In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...

CVE-2025-50978: Improper Neutralization of Input During Web Page Generation

In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...

PT-2025-34880 · Gitblit · Gitblit

Name of the Vulnerable Software and Affected Versions: Gitblit version 1.7.1 Description: Gitblit version 1.7.1 contains a reflected cross-site scripting XSS flaw due to insufficient input sanitization of filename elements when handling repository path names. An attacker can inject a crafted path...

CVE-2025-50978

A reflected cross-site scripting (XSS) vulnerability exists in Gitblit v1.7.1 due to insufficient input sanitization of filename elements during the handling of repository path names. An attacker can inject a specially crafted path payload to cause arbitrary JavaScript execution when a victim vie...

Astra Linux – vulnerability in python3.11

A vulnerability has been found in the CPython venv module and its CLI. Path names provided when creating a virtual environment were not properly quoted, allowing attackers to inject commands into the virtual environment “activation” scripts e.g., “source venv/bin/activate”. As a result, virtual...