CVE-2022-26421

Uncontrolled search path element in the IntelR oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-39952

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via...

CVE-2022-39952

Fortinet FortiNAC is affected by CVE-2022-39952 via an external control of the file name or path in the /configWizard/keyUpload.jsp endpoint. A unauthenticated attacker can write arbitrary files, enabling unauthenticated remote code execution (root context) and potential data loss or modification...

SUSE CVE-2008-4097

MySQL 5.0.51a allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified 1 DATA DIRECTORY or 2 INDEX DIRECTORY arguments that are associated with symlinks within pathnames for subdirectories of the MySQL home data directory, which are followed wh...

SUSE CVE-2010-3366

MnFit 5.13 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

CVE-2022-35868

Siemens TIA Project-Server and TIA Multiuser Server are affected by an untrusted search path vulnerability (CWE-426) that could allow local privilege escalation when a user starts the service from an attacker-controlled path. Affected: TIA Multiuser Server V14 (all), TIA Multiuser Server V15 befo...

CVE-2022-42438

CVE-2022-42438 affects IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3. A root cause of the issue is an insufficient restriction of a directory path, allowing users without admin roles to access admin functions by specifying direct URL paths. Supported details from connected source...

CVE-2022-2893

RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files...

CVE-2022-21191

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function...

Bloom filters 代码问题漏洞

Bloom filters is a Golang-based implementation of Bloom filters. A code issue vulnerability exists in Bloom filters versions prior to 3.3.1 that stems from uncontrolled search path elements...

CVE-2021-36631

Summary: Baidunetdisk versions 7.4.3 and earlier are affected by an untrusted search path vulnerability that enables local privilege escalation via a Trojan horse DLL in an unspecified directory. Root cause: untrusted DLL search path. Impact: local privileges elevation with high confidentiality/i...

CVE-2022-41158

Eyoom Builder (Eyoom) contains a path traversal/remote code execution flaw. Affects versions prior to 4.5.4; vulnerability arises from using cookie values as file paths, enabling remote attackers to execute or inject code. Reported across multiple feeds (CNNVD/CVE entries). Remediation cited: upd...

GHSA-6X99-GV2V-Q76V FPE in `tf.image.generate_bounding_box_proposals`

Impact When running on GPU, tf.image.generateboundingboxproposals receives a scores input that must be of rank 4 but is not checked. python import tensorflow as tf a = tf.constantvalue=1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0 b = tf.constantvalue=1...

qt: QProcess could execute a binary from the current working directory when not found in the PATH

A flaw was found in qt. The vulnerability occurs due to executing binaries from the current directory when the loading path failed, leading to an uncontrolled path element vulnerability. This flaw allows an attacker to execute malicious executables...

The vulnerability of the installation file of the Kaspersky Endpoint Security antivirus software and the Kavremover utility allows a malicious actor to execute an external executable file from within the installation process.

The vulnerability of the installation file of Kaspersky Endpoint Security and the Kavremover utility is related to an uncontrolled element in the search path. Exploiting this vulnerability could allow a malicious actor to execute an external executable file from within the installation process...

CVE-2021-3305

Feishu (Beijing Feishu Technology Co.) v3.40.3 is affected by an untrusted search path vulnerability. The CVE-2021-3305 entry indicates a LOCAL, LOW-ATTACK-CURVE issue with HIGH impact across confidentiality, integrity, and availability, with a CVSSv3.1 base score of 7.8 and UI interaction requir...

CVE-2021-3305

Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability...

GHSA-HHQ3-FF78-JV3G loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)

A regular expression denial of service ReDoS flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils via the resourcePath variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or ta...

Simple Cold Storage Management System SQL注入漏洞

Sourcecodester Simple Cold Storage Management System is a web-based application used as a cold storage business website to provide their customers or prospects with an easily accessible platform to learn about their company. A SQL injection vulnerability exists in Simple Cold Storage Management...

python: open redirection vulnerability in lib/http/server.py may lead to information disclosure

A vulnerability was found in python. This security flaw causes an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of the URI path. This issue may lead to information disclosure...