Lucene search
+L

95 matches found

Kitploit
Kitploit
added 2026/09/03 12:47 a.m.6 views

CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC

CVE-2025-4517 — Python tarfile filter="data" Bypass PoC Vulnerabilidad de Path Traversal en el módulo tarfile de Python que afecta a las versiones 3.8.0 hasta 3.13.1. El sandbox filter="data" — diseñado para evitar extracciones no seguras — puede ser evadido creando rutas que exceden PATHMAX 4096...

9.4CVSS6.5AI score0.01376EPSS
SaveExploits11References1
Tenable Nessus
Tenable Nessus
added 2026/08/30 12:00 a.m.15 views

Linux Distros Unpatched Vulnerability : CVE-2026-82455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination...

7.1CVSS5.4AI score0.00144EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/29 2:16 p.m.5 views

AZL-98403 CVE-2026-82455 affecting package ruby 3.3.5-8

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

7.1CVSS5.8AI score0.00144EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2026/08/29 2:16 p.m.10 views

CVE-2026-82455

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

7.1CVSS5.8AI score0.00144EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/29 1:47 p.m.32 views

CVE-2026-82455 RubyGems before 4.0.13 Path Traversal via Symlink Resolution

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

7.1CVSS0.00144EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/29 1:47 p.m.20 views

CVE-2026-82455 RubyGems before 4.0.13 Path Traversal via Symlink Resolution

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

6.9CVSS5.8AI score
SaveExploits0References6
CVE
CVE
added 2026/08/29 1:47 p.m.28 views

CVE-2026-82455

RubyGems versions before 4.0.13 are vulnerable to a path traversal issue during gem extraction. The root cause is a failure to re-validate path containment after filesystem symlink resolution : if a pre-existing symlink inside the destination directory points outside the extraction root, extracte...

7.1CVSS5.8AI score0.00144EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/29 1:47 p.m.11 views

EUVD-2026-68102

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

7.1CVSS5.8AI score0.00144EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/27 12:30 a.m.8 views

EUVD-2026-66761

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

8.7CVSS5.9AI score0.00497EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/26 10:16 p.m.9 views

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

8.7CVSS0.00497EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/26 9:21 p.m.36 views

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

8.7CVSS0.00497EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/26 9:21 p.m.31 views

CVE-2026-65647

CVE-2026-65647 is an improper symlink resolution vulnerability in the Plesk Site Import and Migrator extensions. A remote authenticated (low-privilege) user can leverage this flaw to execute arbitrary code as root , resulting in full compromise of the vulnerable system. The CVSS 4.0 score is 8.7 ...

8.7CVSS5.9AI score0.00497EPSS
SaveExploits0References1
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.8 views

Astra Linux – Vulnerability in Firefox and Thunderbird

When resolving a symbolic link such as file:///proc/self/fd/1, an error message may be generated if the symbolic link resolves to a string containing uninitialized memory in the buffer. This bug only affects Thunderbird on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected...

8.8CVSS7.1AI score0.00789EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/20 9:47 p.m.16 views

CVE-2026-16989

CVE-2026-16989 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 , where improper resolution of symbolic links allows a local attacker with low privileges to gain elevated privileges (high impact on confidentiality and integrity, no availability impact). The CVSS 3.1 score is 7.1 (HIGH) with a lo...

7.8CVSS5.3AI score0.00129EPSS
SaveExploits0References1Affected Software1
OSV
OSV
added 2026/08/13 3:19 p.m.6 views

AZL-95852 CVE-2026-53784 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

8.4CVSS5.9AI score0.00238EPSS
SaveExploits0References1
AlpineLinux
AlpineLinux
added 2026/08/13 2:34 p.m.10 views

CVE-2026-53784

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

8.4CVSS5.9AI score0.00238EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/24 6:35 p.m.10 views

GO-2026-5490 Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy

Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy...

6.5CVSS5.7AI score0.00389EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/13 3:46 p.m.11 views

PYSEC-2026-2556 LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or t...

5.1CVSS6.1AI score0.0021EPSS
SaveExploits0References6
FreeBSD
FreeBSD
added 2026/07/12 12:00 a.m.10 views

ocaml-opam -- opam install sandbox escape using symlinks

The OCaml Team reports: Installing files through .install files do not check symlinks resolution of the target path, and so can bypass sandboxing. Credits: Reporter: "Kate Deplaix" Remediation Developer: "Nathan Rebours" Remediation Reviewer: "Raja Boujbel" Coordinator: "Hannes Mehnert"...

6.3AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/07 12:00 a.m.21 views

PT-2026-56690

Name of the Vulnerable Software and Affected Versions opam versions prior to 2.5.2 Description Installing files via .install files does not verify symlink resolution of the target path, which allows for the bypass of sandboxing. An attacker can use a malicious .install file in combination with a...

5.7CVSS5.9AI score
SaveExploits0References5
Rows per page
Query Builder