Amazon Linux 2 : acl, --advisory ALAS2-2026-3831 (ALAS-2026-3831)

The version of acl installed on the remote host is prior to 2.2.51-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3831 advisory. A flaw was found in the acl component, specifically within its libacl pathname-based functions. A local attacker could exploit this...

Important: acl

Issue Overview: A flaw was found in the acl component, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or wri...

EUVD-2016-2751

Malware in sbrugna...

EUVD-2019-13331

Malware in sbrugna...

EUVD-2002-0571

Malware in sbrugna...

EUVD-2022-35190

Malicious code in bioql PyPI...

CVE-2019-12277

Blogifier 2.3 before 2019-05-11 does not properly restrict APIs, as demonstrated by missing checks for .. in a pathname...

CVE-2022-27818

SWHKD 1.1.5 has a vulnerability due to insecure handling of the /tmp/swhkd.sock pathname, exposing information and enabling denial of service. The issue is tied to insecure temporary file/socket usage. Affected component: SWHKD 1.1.5 (Rust-based daemon). Impact, per sources: potential information...

RHEL 8 : gegl04 (RHSA-2022:0177)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0177 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gegl: shell expansion via a crafted pathname CVE-2021-4546...

CVE-2021-24010

CVE-2021-24010 — Fortinet FortiSandbox contains a path traversal (CWE-22) vulnerability. Affected versions: FortiSandbox 3.2.0–3.2.2 and 3.1.0–3.1.4. An authenticated user can obtain unauthorized access to files and data via specially crafted web requests due to improper limitation of a pathname ...

CVE-2020-27534

util/binfmtmisc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathname, constructed with an empty first argument in an ioutil.TempDir call...

CVE-2020-35176

In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname omitting the initial /etc, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600...

CVE-2019-3696

A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise...

Integer overflow

stdlib/canonicalize.c in the GNU C Library aka glibc or libc6 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution...

CVE-2011-5289

The SaveDecrypted method in the ChilkatCrypt2.ChilkatOmaDrm.1 ActiveX control in ChilkatCrypt2.dll in aTube Catcher 2.3.570 allows remote attackers to write to arbitrary files via a pathname in the argument...

CVE-2013-6955

webman/imageSelector.cgi in Synology DiskStation Manager DSM 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header...

CVE-2013-3154

CVE-2013-3154 affects Windows Defender on Windows 7 and Windows Server 2008 R2. The issue is caused by an incorrect pathname used by the signature-update functionality, enabling local users to gain privileges via a Trojan horse in the %SYSTEMDRIVE% top-level directory. A successful exploit allows...

CVE-2013-1671

Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site...

CVE-2013-1671

Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site...

CVE-2007-2452

Heap-based buffer overflow in the visitoldformat function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036...