E-Solutions E-Management 路径遍历漏洞

E-Solutions E-Management is an application from E-Solutions, Inc. A path traversal vulnerability exists in E-Solutions E-Management that originates from path traversal and could result in access to confidential files outside of the expected scope...

Security Bulletin: IBM InfoSphere Information Server Low Level Authenticated User Can View Higher Level User And Group Listing (CVE-2022-36772)

Summary A vulnerability in IBM InfoSphere Information Server allowed lower level authenticated user to view other users and groups list. The scope of the vulnerability was limited in nature. The flaw gave such users VIEW access only. This vulnerabity was addressed. Vulnerability Details...

PT-2025-18406

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug in the Linux kernel has been resolved, specifically an issue where an array was used outside of its scope in the crc t10dif arch function. This bug has been fixed. Recommendations ...

PT-2025-18407

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug in the Linux kernel has been resolved, specifically in the arm/crc-t10dif component, where an array was used outside of its scope in the crc t10dif arch function. This issue has be...

SUSE CVE-2025-27553

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file...

The vulnerability of the resolveFile method in the unified API for accessing various file systems in Apache Commons VFS allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the resolveFile method in the unified API for accessing various file systems using Apache Commons VFS is related to errors in processing the relative path to the directory when handling the scope parameter. Exploiting this vulnerability could allow an attacker to gain...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the resolveFile method when the scope parameter is set to NameScope.DESCENDENT. An attacker can access files outside of the intended directory by including encoded directory traversal sequences such as %2E%2E...

Varnish Enterprise 安全漏洞

Varnish Enterprise is a high-performance caching software from Varnish, Inc. It is used to handle high traffic and optimize business. A security vulnerability exists in Varnish Enterprise versions prior to 6.0.13r13 that stems from a scope request that could lead to out-of-bounds reading of...

Directory Traversal

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Directory Traversal through the /delete-workflow endpoint. An attacker can delete arbitrary files from the filesystem by manipulating file paths to access...

CVE-2024-8501

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management when handling namespace scopes for BMCEventSubscription. A user with namespace level roles can access and manipulate secrets from unauthorized namespaces by creating a BMCEventSubscription in a namespace th...

dng_sdk:dng_validate_fuzzer: Stack-use-after-scope in RefCopyBytes

Detailed Report: https://oss-fuzz.com/testcase?key=5507240056651776 Project: dngsdk Fuzzing Engine: afl Fuzz Target: dngvalidatefuzzer Job Type: aflasandngsdk Platform Id: linux Crash Type: Stack-use-after-scope READ Crash Address: 0x7a9af6806d74 Crash State: RefCopyBytes dngstream::Put...

GHSA-C98H-7HP9-V9HQ Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD

Impact The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource BMCEventSubscription BMCES. An adversary Kubernetes account wit...

CVE-2025-27794 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain e.g., subdomain.host.com sets cookies scoped to the parent domain .host.com. This allows session token replacement f...

PT-2025-10736

Name of the Vulnerable Software and Affected Versions Tecnomatix Plant Simulation versions prior to V2302.0021 Tecnomatix Plant Simulation versions prior to V2404.0010 Description The affected application does not properly restrict the scope of files accessible to the simulation model. This could...

CVE-2024-51954

There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone unfederated ArcGIS Server instance. Successful...

PYSEC-2025-19

picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not...

picklescan 安全漏洞

picklescan is a security scanning program by the individual developer Matthieu Maitre. A security vulnerability exists in versions of picklescan prior to 0.0.22, which stems from an improperly restricted scanning scope that could lead to malicious files bypassing security checks...

CVE-2024-51954: Improper Access Control

There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone unfederated ArcGIS Server instance. Successful...

io.quarkus:quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information...