7433 matches found
Local File Inclusion (LFI)
Ray is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper validation and access control in Ray's /static/ directory, which allows attackers to specify and access arbitrary file paths without authentication...
PT-2025-4814 · Node.Js · Node.Js
Name of the Vulnerable Software and Affected Versions: Node.js affected versions not specified Description: A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special ...
Hashicorp Go-slug backend link vulnerability
HashiCorp Hashicorp Go-slug is a Go-based codebase for packing and unpacking files from HashiCorp, USA. A security vulnerability exists in Hashicorp Go-slug version 0.16.2 and earlier, which stems from the fact that HashiCorp's go-slug library is susceptible to a zip-slip style attack when...
Epic Games Launcher code-related vulnerabilities
Epic Games Launcher is a game software launcher from Epic Games USA. A code issue vulnerability exists in Epic Games Launcher version 17.2.1 and earlier, which stems from code in the profapi.dll library in the component Installer that can lead to untrusted search paths...
SUSE CVE-2024-23331
Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...
CLSA-2025-1737153672 git: Fix of CVE-2024-32002
CVE-2024-32002: fix submodule paths to not contain symlinks...
Palo Alto Networks Expedition Configuration Migration File Deletion
The vulnerability of the Palo Alto Networks Expedition configuration migration tool is related to incorrect external management of file names or file paths. Exploiting this vulnerability allows a malicious actor to delete arbitrary files remotely...
AZL-55831 CVE-2024-57887 affecting package kernel for versions less than 6.6.76.1-1
In the Linux kernel, the following vulnerability has been resolved: drm: adv7511: Fix use-after-free in adv7533attachdsi The hostnode pointer was assigned and freed in adv7533parsedt, and later, adv7533attachdsi uses the same. Fix this use-after-free issue by dropping ofnodeput in adv7533parsedt...
CVE-2025-23042 Gradio Blocked Path ACL Bypass Vulnerability
Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This...
Improper Handling of Case Sensitivity
Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to improper case normalization in the file path validation logic through the blockedpaths parameter of the...
CVE-2024-47571
creationtimestamp| type| source ---|---|--- 2025-01-14 14:17:40+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfpgwnq6iw2t 2025-01-14 14:48:26+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113827257100178968 2025-01-14 15:13:33+00:00| seen|...
CLSA-2025-1736856534 python3.11: Fix of CVE-2024-9287
CVE-2024-9287: Quote path names when creating virtual environments to prevent command injection in activation scripts...
RetroArch code issues and vulnerabilities
RetroArch is a reference front-end to the Libretro API open-sourced by Libretro. A code issue vulnerability exists in RetroArch versions prior to 1.19.1, which stems from some functionality in the component Startup profapi.dll that leads to untrusted search paths...
Gradio authorization issue vulnerability
Gradio, an open source Python library from Gradio Open Source, is a method for demonstrating machine learning models through a friendly web interface. An authorization issue vulnerability exists in Gradio versions prior to 5.6.0 that stems from a lack of normalization of the path validation logic...
SUSE CVE-2024-55639
In the Linux kernel, the following vulnerability has been resolved: net: renesas: rswitch: avoid use-after-put for a device tree node The device tree node saved in the rswitchdevice structure is used at several driver locations. So passing this node to ofnodeput after the first use is wrong. Move...
DEBIAN-CVE-2024-55639
In the Linux kernel, the following vulnerability has been resolved: net: renesas: rswitch: avoid use-after-put for a device tree node The device tree node saved in the rswitchdevice structure is used at several driver locations. So passing this node to ofnodeput after the first use is wrong. Move...
UBUNTU-CVE-2024-55639
In the Linux kernel, the following vulnerability has been resolved: net: renesas: rswitch: avoid use-after-put for a device tree node The device tree node saved in the rswitchdevice structure is used at several driver locations. So passing this node to ofnodeput after the first use is wrong. Move...
Gradio < 4.19.2 Vulnerability - CVE-2024-1728
The version of Gradio installed on the remote host is prior to 4.19.2. It is, therefore, affected by a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the...
U.S. Dept Of Defense: ASP.NET Application Trace Enabled
The ASP.NET application trace feature was enabled on a public-facing URL, which exposed sensitive internal information, including Session ID values and the physical file paths of server-side resources. This vulnerability could have allowed attackers to gain unauthorized insights into the server...
ALPINE-CVE-2024-37372
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...