20 matches found
CLEANSTART-2026-UN12149 path-to-regexp turns path strings into a regular expressions
Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...
CLEANSTART-2026-YZ16271 path-to-regexp turns path strings into a regular expressions
Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...
CLEANSTART-2026-HD43718 path-to-regexp turns path strings into a regular expressions
Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...
ALPINE-CVE-2026-47215
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...
CVE-2026-47215
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...
CVE-2026-47215: Improper Limitation of a Pathname to a Restricted Directory
SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...
GHSA-88FW-V6X4-3F58 Spring Data: Unbounded property-path cache keyed by externally-supplied path string
src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175 · Unbounded Resource Allocation Algorithmic DoS Impact When a consuming module routes user-supplied dot-paths sort parameters, projection paths, PATCH paths through...
GHSA-7CR3-H577-G38J rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)
The --preserve-root check uses a path-string test path.hasroot && path.parent.isnone rather than comparing device/inode. A symlink to / e.g. /tmp/rootlink - / has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it...
rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)
The --preserve-root check uses a path-string test path.hasroot && path.parent.isnone rather than comparing device/inode. A symlink to / e.g. /tmp/rootlink - / has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it...
Duplicate Advisory: uutils coreutils has a Link Following Issue Via rm Utility
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7cr3-h577-g38j. This link is maintained to preserve external references. Original Description A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The...
CVE-2026-35349
A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a...
CVE-2019-25683: Insertion of Sensitive Information into Log File
FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying a malformed path string. Attackers can trigger the crash by entering a crafted path containing 384 'A' characters followed by 'BBBB' and...
MAL-2025-8608 Malicious code in @malware-test-drail-reran-otter-theek/test-mlw3-drail-reran-otter-theek (npm)
The package @malware-test-drail-reran-otter-theek/test-mlw3-drail-reran-otter-theek was found to contain malicious code...
CVE-2019-17137
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings...
CVE-2019-17137: Null Byte Interaction Error (Poison Null Byte)
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings...
CVE-2018-5137: Exposure of Sensitive Information to an Unauthorized Actor
A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this by using a maliciously crafted path string to reference the resources. Note: this vulnerability does not affect WebExtensions. This vulnerability affects...
PT-2018-3584
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 59 Description The issue allows a malicious web page to load non-content accessible resources of a legacy extension through a script, using a crafted path string. This does not affect WebExtensions. Recommendations Fo...
Mozilla Thunderbird Path String Vulnerability
Mozilla Thunderbird is the United States Mozilla Foundation developed from the Mozilla Application Suite independent of the e-mail client software, support for IMAP, POP mail protocol and HTML mail format. A path string vulnerability exists in Mozilla Thunderbird versions prior to 52.5.2. An...
openSUSE: Security Advisory for Mozilla (openSUSE-SU-2017:3434-1)
The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
