141202 matches found
Fortinet FortiMail Path Traversal / NULL Byte Arbitrary File Write (FG-IR-26-175)
The version of FortiMail installed on the remote host is affected by a path traversal vulnerability as referenced in the FG-IR-26-175 advisory. - An improper limitation of a pathname to a restricted directory 'Path Traversal' combined with an improper neutralization of NULL byte or NULL character...
uv: Path traversal on Windows through wheel extraction
Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...
EUVD-2026-91675
uv: Path traversal on Windows through wheel extraction...
GHSA-2CV4-CQWR-GWF7 uv: Path traversal on Windows through wheel extraction
Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...
EUVD-2026-90363
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup...
GHSA-5639-2J2P-M4MX Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...
GHSA-2MJX-QC3C-RQVC Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. The handshake transcript is still authenticated, so a network-position attacker cannot use this to alter or complete a handshake; the practical effect is tha...
Nx: Path traversal in nx migrate package-migrations extraction
Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...
EUVD-2026-91761
Nx: Path traversal in nx migrate package-migrations extraction...
GHSA-HRVQ-X7JP-36XV Nx: Path traversal in nx migrate package-migrations extraction
Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...
NPM: Nx: Path traversal in nx migrate package-migrations extraction
NPM: Nx: Path traversal in nx migrate package-migrations extraction vulnerability discovered by ? in WordPress Npm nx versions = 13.10.0, 22.7.10...
GHSA-5H3F-Q97H-CCVC vm2: NodeVM custom resolution bypasses external path boundaries
Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...
NPM: vm2: NodeVM custom resolution bypasses external path boundaries
NPM: vm2: NodeVM custom resolution bypasses external path boundaries vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...
vm2: NodeVM custom resolution bypasses external path boundaries
Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...
CVE-2023-1177
CVE-2023-1177 | | MLFlow 路径遍历 | 已在 MLflow 2.2.0 上测试 | src: https://github.com/iumiro/CVE-2023-1177-MLFlow | .. code-block:: bash !/bin/bash RAND="EXPLOIT-$1+$RANDOM%9999" URL="http://172.17.0.2:6001" FILE='/root/.ssh/idrsa' curl -vX POST "$URL/ajax-api/2.0/mlflow/registered-models/create" -d...
CVE-2024-23774
CVE-2024-23774 - 未加引号的Windows服务路径漏洞 信息将在适当时候提供。...
CVE-2019-17234b-Exploit
WordPress IgniteUp 插件漏洞 WordPress IgniteUp 插件 v3.4 及以下版本允许远程未认证用户潜在地任意删除目标 Web 服务器上的任何文件，可能导致拒绝服务攻击。 CVE-2019-17234 时间线 该漏洞于 2019 年 9 月 20 日报告给 wordpress.org 团队，新版本插件 3.4.1 于 2019 年 11 月 8 日发布。3 背景 IgniteUp 是一款流行的 WordPress 插件，用于简化网站着陆页的设置和管理，让用户知道网站即将上线、正在维护或正在建设中。 该插件开箱即用地提供 5...
GHSA-7G7C-H8RR-7P6Q Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...