UBUNTU-CVE-2024-57966

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive...

The vulnerability of the software for centralized device management in Fortinet FortiManager, as well as security event monitoring and analysis tools FortiAnalyzer, arises due to errors in processing the relative path to the directory. This allows a malicious actor to execute arbitrary code.

The vulnerability of the software for centralized device management of Fortinet FortiManager, as well as security event monitoring and analysis tools FortiAnalyzer, is related to errors in processing the relative path to the directory. Exploiting this vulnerability allows a malicious actor to...

KDE Ark 安全漏洞

KDE Ark is a graphical file compression/decompression utility for the KDE community. A security vulnerability exists in KDE Ark versions prior to 24.12.0, which stems from the fact that libarchiveplugin.cpp can extract absolute paths from archives...

AZL-56333 CVE-2025-21683 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfskselectreuseport memory leak As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SOATTACHREUSEPORTEBPF set before it was ESTABLISHED. In other...

UBUNTU-CVE-2025-21683

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfskselectreuseport memory leak As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SOATTACHREUSEPORTEBPF set before it was ESTABLISHED. In other...

CVE-2025-21683 bpf: Fix bpf_sk_select_reuseport() memory leak

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfskselectreuseport memory leak As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SOATTACHREUSEPORTEBPF set before it was ESTABLISHED. In other...

Pioneer DMH-WT7600NEX 安全漏洞

The Pioneer DMH-WT7600NEX is a multimedia digital media receiver from Pioneer. A security vulnerability exists in the Pioneer DMH-WT7600NEX that stems from a lack of proper authentication before using a user-supplied path in a file operation. An attacker can exploit the vulnerability to execute...

UBUNTU-CVE-2025-0781

An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level...

CVE-2025-0750 Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting

A vulnerability was found in CRI-O. A path traversal issue in the log management functions UnMountPodLogs and LinkContainerLogs may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system...

SUSE CVE-2025-0750

A vulnerability was found in CRI-O. A path traversal issue in the log management functions UnMountPodLogs and LinkContainerLogs may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system...

PT-2025-4037 · Cri-O +1 · Cri-O +1

Name of the Vulnerable Software and Affected Versions: CRI-O affected versions not specified Description: A path traversal issue in the log management functions, specifically UnMountPodLogs and LinkContainerLogs, may allow an attacker with permissions to create and delete Pods to unmount arbitrar...

CRI-O 路径遍历漏洞

CRI-O is a CRI-O open source lightweight container runtime environment for Kubernetes systems. CRI-O suffers from a path traversal vulnerability that stems from a path traversal issue in the log management feature, allowing an attacker to offload arbitrary host paths and cause a node-level denial...

CVE-2024-57514

The CVE-2024-57514 entry concerns the TP-Link Archer A20 v3 router. Affected component is the web interface’s directory listing handling, where improper processing of listing paths enables Cross-site Scripting (XSS) when a crafted URL is visited. This allows injection of arbitrary JavaScript that...

Apache Solr Relative Path Traversal vulnerability

Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths t...

PT-2025-47805

Name of the Vulnerable Software and Affected Versions macOS versions prior to Ventura 13.7.3 macOS versions prior to Sonoma 14.7.3 macOS versions prior to Sequoia 15.5 Description A flaw exists in how the operating system parses directory paths. This can lead to an application gaining access to...

Rise Mode Temp CPU 代码问题漏洞

Rise Mode Temp CPU is a CPU driver from Rise. A code issue vulnerability exists in Rise Mode Temp CPU version 2.1, which stems from the library CRYPTBASE.dll of the component Startup that leads to untrusted search paths...

SUSE CVE-2025-23084

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory...

Local File Inclusion (LFI)

Ray is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper validation and access control in Ray's /static/ directory, which allows attackers to specify and access arbitrary file paths without authentication...

Hashicorp Go-slug 后置链接漏洞

HashiCorp Hashicorp Go-slug is a Go-based codebase for packing and unpacking files from HashiCorp, USA. A security vulnerability exists in Hashicorp Go-slug version 0.16.2 and earlier, which stems from the fact that HashiCorp's go-slug library is susceptible to a zip-slip style attack when...

PT-2025-4814 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js affected versions not specified Description: A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special ...