CVE-2026-57825

A flaw was found in the opam package manager for OCaml. This vulnerability allows a malicious package to bypass the sandbox protection mechanism. By mishandling symlinks during the processing of .install files, an attacker can write arbitrary files to unintended locations on the system, potential...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

CVE-2026-57825

In opam (OCaml package manager) versions before 2.5.2 , the sandbox protection mechanism can be bypassed due to mishandled symlinks during .install file processing. Specifically, installing files through .install files did not check symlink resolution on the target path, allowing a package to ins...

EUVD-2026-74594

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

AZL-88278 CVE-2026-5223 affecting package rust for versions less than 1.90.0-9

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is medium for users of third-party registries. Users of crates.io a...

MiracleLinux 8 : patch-2.7.6-11.el8 (AXSA:2020-262:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-262:01 advisory. patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files CVE-2019-13636 Tenable has extracted the preceding...

Apple macOS Tahoe Symbolic Link Mishandling Vulnerability (CNVD-2025-3115302)

Apple macOS Tahoe is a desktop operating system released by Apple on June 10, 2025, using the LiquidGlass design language and integrating several AI and cross-device features. Apple macOS Tahoe suffers from a symbolic link mishandling vulnerability that stems from insufficient security restrictio...

EUVD-2019-4335

Malware in sbrugna...

EUVD-2015-5692

Malware in sbrugna...

EUVD-2019-5064

Malware in sbrugna...

EUVD-2018-15898

Malware in sbrugna...

EUVD-2017-11573

Malware in sbrugna...

CVE-2024-45845

Rejected reason: DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2024-45593. Reason: This record is a reservation duplicate of CVE-2024-45593. Notes: All CVE users should reference CVE-2024-45593 instead of this record. All references and descriptions in this record have been removed to prevent...

RHEL 5 : dbus (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - dbus: users with the same numeric UID could lead to use-after-free and undefined behaviour CVE-2020-35512...

Oracle Linux 8 : dbus (ELSA-2019-3707)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3707 advisory. 1.12.8-9.0.1 - fix netlink poll: error 4 Zhenzhong Duan 1:1.12.8-9 - Ensure that patches are applied 1725570 1:1.12.8-8 - Fix CVE-2019-12749 1725570 Tenable has...

K25719440: D-Bus vulnerability CVE-2019-12749

Security Advisory Description dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 and in some, less common, uses of dbus-daemon, allows cookie spoofing because of symlink mishandling in the reference implementation of...

SUSE CVE-2019-12749

dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 and in some, less common, uses of dbus-daemon, allows cookie spoofing because of symlink mishandling in the reference implementation of DBUSCOOKIESHA1 in the libdbus...

Amazon Linux 2 : dbus (ALAS-2022-1870)

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1870 advisory. A flaw was found in dbus. The implementation of DBUSCOOKIESHA1 is susceptible to a symbolic link attack. A malicious client...