EUVD-2025-11220

Malicious code in bioql PyPI...

EUVD-2025-25049

Malicious code in bioql PyPI...

A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.

...

Symlink Attack

github.com/hashicorp/go-getter is vulnerable to Symlink Attack. The vulnerability is due to the subdirectory download feature allowing symbolic links to escape designated directory boundaries and access unauthorized files...

Linux Distros Unpatched Vulnerability : CVE-2020-12062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user ...

DEBIAN-CVE-2025-8959

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9...

CVE-2025-8959 HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9...

CVE-2025-8959

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9...

CVE-2025-8959 HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9...

CVE-2025-8959

CVE-2025-8959 affects HashiCorp’s go-getter library: the subdirectory download feature is vulnerable to symlink attacks that can cause unauthorized reads outside the designated directory. The root cause is improper path resolution when following symlinks in subdirectory downloads. Impact is unaut...

HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

Summary HashiCorp’s go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9. Background HashiCorp’s go-getter is a...

PT-2025-33508

Name of the Vulnerable Software and Affected Versions: go-getter versions prior to 1.7.9 Description: The go-getter library subdirectory download feature is susceptible to symlink attacks, potentially allowing unauthorized read access beyond the intended directory boundaries. Recommendations:...

Linux Distros Unpatched Vulnerability : CVE-2020-12415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When %2F was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could...

CVE-2025-24916

When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default...

CVE-2020-11930

The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option...

Tenable Nessus Agent 安全漏洞

Tenable Nessus Agent is a vulnerability scanning program from Tenable USA. A security vulnerability exists in Tenable Nessus Agent versions prior to 10.8.3, which stems from a failure to enforce security permissions on subdirectories when installed to a non-default location on a Windows host,...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app that used persistent directories could access and write files outside of its usual access rights, which constituted an attack on integrity and...

CVE-2024-42472

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

CVE-2024-22002

CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory...

CVE-2024-22002

CORSAIR iCUE 5.9.105 on Windows is affected by a DLL hijacking vulnerability in the cuepkg-1.2.6 subdirectory used during updates by the iCUEUpdateService. An unprivileged user who can write to that directory can place a malicious DLL (e.g., MSASN1.dll, NTASN1.dll, profapi.dll) that will be loade...