CVE-2025-66221

Werkzeug CVE-2025-66221 affects the safe_join path handling in Werkzeug prior to 3.1.4 on Windows. If a request ends with a Windows device name (e.g., CON, AUX), the file is opened but reading can hang indefinitely when using send_from_directory under a directory. The issue has been patched in 3....

CVE-2025-66221

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safejoin function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory...

Werkzeug 安全漏洞

Werkzeug is a comprehensive WSGI web application library open-sourced by Pallets. A security vulnerability exists in Werkzeug versions prior to 3.1.4, which stems from improper handling of Windows device names by the safejoin function, which may result in file read hangs...

CVE-2025-35967

Out-of-bounds read for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This...

CVE-2025-55677

Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

CVE-2025-50174

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

CVE-2025-55677 Windows Device Association Broker Service Elevation of Privilege Vulnerability

...

EUVD-2025-34429

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

Windows Device Association Broker Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

PT-2025-41999

Name of the Vulnerable Software and Affected Versions Windows versions affected versions not specified Description A use after free condition exists in the Windows Device Association Broker service. This allows an authorized attacker to elevate privileges locally. A use-after-free occurs when a...

EUVD-2020-2301

Malware in sbrugna...

EUVD-2024-18016

Malicious code in bioql PyPI...

EUVD-2022-38148

Malicious code in bioql PyPI...

BIT-NODE-MIN-2025-27210

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API...

BIT-NODE-2025-27210

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API...

CVE-2025-27210

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API...

CVE-2025-27210

Node.js on Windows is affected by a path.join handling vulnerability affecting drive names (CON, PRN, AUX). CVE-2025-27210 notes an incomplete fix for CVE-2025-23084, indicating Windows device-name handling was not treated as special, causing a path that should be relative to be interpreted with ...

CVE-2025-27210

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of path.join API...

PT-2025-29688 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js versions 20.x through 20.19.3 Node.js versions 22.x through 22.17.0 Node.js versions 24.x through 24.4.0 Description: The path.normalize function in Node.js does not properly restrict Windows device names such as CON, PRN, and AUX...

Node.js 20.x < 20.19.4 / 22.x < 22.17.1 / 24.x < 24.4.1 Multiple Vulnerabilities (Tuesday, July 15, 2025 Security Releases).

The version of Node.js installed on the remote host is prior to 20.19.4, 22.17.1, 24.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Tuesday, July 15, 2025 Security Releases advisory. - The V8 release used in Node.js v24.0.0 has changed how string hashes are...