CVE-2024-51320

Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdmfsavehtmltmp, /servlet/gsdmbtlkopenfile components...

CVE-2025-27397

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write...

CVE-2025-27398

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly neutralize special characters when interpreting user controlled log paths. This could allow an authenticated highly-privileged remote attacker to execute a limited set of...

CVE-2025-27398

CVE-2025-27398 affects Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) prior to version 4.0. The issue is an OS command injection where user-controlled log paths are not properly neutralized, enabling an authenticated, highly-privileged attacker to run a limited set of binaries already present on t...

CVE-2025-27397

Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) is affected by CVE-2025-27397. All versions below V4.0 fail to properly restrict user-controlled log paths, enabling an authenticated, highly-privileged attacker to read and write arbitrary files if the path ends with 'log'. Connected sources confirm ...

CVE-2025-27397

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write...

CVE-2025-27397

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write...

Siemens SCALANCE LPE9403 操作系统命令注入漏洞

Siemens SCALANCE LPE9403 is a native processing engine for industrial field data processing from Siemens, Germany. It is used to capture, collect and pre-process industrial field data. Siemens SCALANCE LPE9403 6GK5998-3GS00-2AC2 V4.0 and prior versions suffer from an operating system command...

PT-2025-10642 · Rack +5 · Rack +5

Name of the Vulnerable Software and Affected Versions: Rack versions prior to 2.2.13, 3.0.14, and 3.1.12 Description: The vulnerability occurs because Rack::Static does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly...

Virtual environment (venv) activation scripts don't quote paths

...

CVE-2025-21841

CVE-2025-21841 : Linux kernel vulnerability in cpufreq/amd-pstate where amd_pstate_update_limits() takes a cpufreq_policy reference but fails to decrement the refcount on an exit path. This can lead to a use-after-free or resource mismanagement depending on refcount handling. The issue is resolve...

Local Privilege Escalation

Mongosh is vulnerable to local privilege escalation. The vulnerability is due to improper handling of library loading paths, where mongosh searches for and executes files from C:\nodemodules\ without proper validation, allowing an attacker to place a malicious file and gain elevated privileges...

Linux Distros Unpatched Vulnerability : CVE-2023-52661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/tegra: rgb: Fix missing clkput in the error handling paths of tegradcrgbprobe If...

Linux Distros Unpatched Vulnerability : CVE-2024-47687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix invalid mr resource destroy Certain error paths from mlx5vdpadevadd can end u...

Linux Distros Unpatched Vulnerability : CVE-2015-3409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working...

Path Traversal

org.noear:solon-web-staticfiles is vulnerable to Path Traversal. The vulnerability is due to improper validation of user-supplied file paths in StaticMappings.java, allowing an attacker to access arbitrary files using "../filedir"...

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Hitachi Vantara Pentaho BA Server contains a use of non-canonical URL paths for authorization decisions vulnerability that enables an attacker to bypass authorization...

CVE-2022-49373

In the Linux kernel, the following vulnerability has been resolved: watchdog: ts4800wdt: Fix refcount leak in ts4800wdtprobe ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when done. Add missing ofnodeput in some error paths...

SUSE CVE-2021-47655

In the Linux kernel, the following vulnerability has been resolved: media: venus: vdec: fixed possible memory leak issue The venushelperallocdpbbufs implementation allows an early return on an error path when checking the id from idaallocmin which would not release the earlier buffer allocation...

SUSE CVE-2022-49064

In the Linux kernel, the following vulnerability has been resolved: cachefiles: unmark inode in use in error path Unmark inode in use if error encountered. If the in-use flag leakage occurs in cachefilesopenfile, Cachefiles will complain "Inode already in use" when later another cookie with the...