CVE-2010-5237

Untrusted search path vulnerability in CyberLink PowerDirector 7 allows local users to gain privileges via a Trojan horse mfc71loc.dll file in the current working directory, as demonstrated by a directory that contains a .pdl, .iso, .pds, .p2g, or .p2i file. NOTE: some of these details are obtain...

CVE-2010-5202

Untrusted search path vulnerability in JetAudio 8.0.7.1000 Basic allows local users to gain privileges via a Trojan horse WNASPI32.DLL file in the current working directory, as demonstrated by a directory that contains a .mp3 file. NOTE: some of these details are obtained from third party...

CVE-2010-2476

syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedir path to use that domain documentroot...

CVE-2023-33861 IBM Security ReaQta improper certificate validation

IBM Security ReaQta EDR 3.12 could allow an attacker to spoof a trusted entity by interfering with the communication path between the host and client...

e-Diary Management System /manage-notes.php File SQL Injection Vulnerability

The e-Diary Management System is an electronic diary management system. The e-Diary Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter ID of the file /manage-notes.php. An attacker can...

Adobe Substance 3D Modeler Uncontrolled Search Path Element Vulnerability

Adobe Substance 3D Modeler is a 3D modeling and sculpting software from the American company Audobee Adobe. Adobe Substance 3D Modeler suffers from an uncontrolled search path element vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

CVE-2024-47795

CVE-2024-47795 affects Intel® oneAPI DPC++/C++ Compiler (and FPGA Support Package for Windows) prior to 2025.0.0. The vulnerability is an uncontrolled search path that could enable local privilege escalation when an authenticated user gains local access. The issue is supported by multiple feeds (...

GHSA-Q3M2-CRGQ-5P3Q OpenStack Ironic fails to restrict paths used for file:// image URLs

OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling if a deployment was performed via the API. A malicious project assigned as a node owner can provide a path to any local file readable by ironic-conductor, which may then be written to the target...

CVE-2023-53041 scsi: qla2xxx: Perform lockless command completion in abort path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Perform lockless command completion in abort path While adding and removing the controller, the following call trace was observed: WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dmafreeattrs+0x33/0x50 CPU:...

VulnCheck KEV: CVE-2025-24054

Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network...

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Summary The contents of arbitrary files can be returned to the browser. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Details .svg Requests ending with .svg are loaded at this line...

CVE-2024-7058

A vulnerability in the sanitizepath function in parisneo/lollms-webui v10 - latest allows an attacker to bypass path sanitization by using relative paths such as './'. This can lead to unauthorized access to directories within the personalityfolder on the victim's computer...

CVE-2024-8616 Arbitrary File Overwrite in h2oai/h2o-3

In h2oai/h2o-3 version 3.46.0, the /99/Models/name/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for...

CVE-2025-27397

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write...

Vulnerability of the development, debugging, and optimization tools for FPGA applications. The Intel oneAPI DPC++/C++ compiler’s support package is vulnerable due to an uncontrolled search path element, allowing attackers to exploit this vulnerability to gain enhanced privileges.

The vulnerability of the FPGA Support Package for the Intel oneAPI DPC++/C++ Compiler relates to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the INF-file utility for Intel chipset and circuit boards, known as the Intel Chipset INF Utility (previously called Intel Chipset Device Software or Intel Chipset Software Installation Utility), is related to an uncontrolled search path element. This allows a malicious user to gain elevated privileges.

The vulnerability of the INF-file utility for Intel chipset and circuit boards is related to an uncontrolled search path element. Exploiting this vulnerability can allow a hacker to gain increased privileges...

CVE-2024-6097

In Progress® Telerik® Reporting versions prior to 2025 Q1 19.0.25.211, information disclosure is possible by a local threat actor through an absolute path vulnerability...

Progress Telerik Reporting < 2025 Q1 (19.0.25.211) Information Disclosure

The version of Progress Telerik Reporting installed on the remote Windows host is prior or equal to 2025 QA 19.0.25.211. It is, therefore, affected by an information disclosure vulnerability. Information disclosure is possible by a local threat actor through an absolute path vulnerability. Note...

CVE-2024-6097

In Progress® Telerik® Reporting versions prior to 2025 Q1 19.0.25.211, information disclosure is possible by a local threat actor through an absolute path vulnerability...

CVE-2024-6097 Absolute Path Traversal Vulnerability

In Progress® Telerik® Reporting versions prior to 2025 Q1 19.0.25.211, information disclosure is possible by a local threat actor through an absolute path vulnerability...