89 matches found
GHSA-866W-XMHQ-WJ7X SvelteKit: Prototype pollution in file input deletion path in remote-function forms
If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype...
The vulnerability of the ColdFusion software platform arises from incorrect restrictions on path names in the catalog, allowing attackers to execute arbitrary code.
The vulnerability of the ColdFusion software platform is related to incorrect restrictions on path names in the directory structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
ROS-20260713-73-0025
The vulnerability in Python-Relenv relates to incorrect path name restrictions for the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
CVE-2026-28705 Gitea repository dumps write release assets using unsafe path names
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths...
CVE-2026-8362
A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long URL path starting with /woshome...
The vulnerability of the software for creating and managing graphical user interfaces for Rockwell Automation FactoryTalk View Machine Edition devices lies in improper restrictions on path names to restricted directories. This allows attackers to trigger service failures.
The vulnerability of the software for creating and managing graphical user interfaces on Rockwell Automation FactoryTalk View Machine Edition industrial devices is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a...
EUVD-2014-3655
Malware in sbrugna...
EUVD-2025-28380
Malicious code in bioql PyPI...
CVE-2025-50978
In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...
CVE-2025-50978
In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...
CVE-2025-50978
In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...
CVE-2025-50978: Improper Neutralization of Input During Web Page Generation
In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...
PT-2025-34880 · Gitblit · Gitblit
Name of the Vulnerable Software and Affected Versions: Gitblit version 1.7.1 Description: Gitblit version 1.7.1 contains a reflected cross-site scripting XSS flaw due to insufficient input sanitization of filename elements when handling repository path names. An attacker can inject a crafted path...
CVE-2025-50978
In Gitblit v1.7.1, a reflected cross-site scripting XSS vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient...
CVE-2025-50978
A reflected cross-site scripting (XSS) vulnerability exists in Gitblit v1.7.1 due to insufficient input sanitization of filename elements during the handling of repository path names. An attacker can inject a specially crafted path payload to cause arbitrary JavaScript execution when a victim vie...
Astra Linux – Vulnerability in Python 3.11
A vulnerability has been identified in the CPython venv module and CLI. This vulnerability arises from improper quoting of path names when creating a virtual environment. As a result, attackers can inject commands into the virtual environment “activation” scripts e.g., using “source...
CVE-2023-2117
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the getsubdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root...
The vulnerability of the Ivanti EPM endpoint management software lies in the improper restriction of path names in the catalog, which allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the Ivanti EPM endpoint management software is related to incorrect restrictions on path names in the catalog. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...