64 matches found
PT-2026-147264
CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can ...
Python Packaging Authority virtualenv post-link vulnerability
The Python Packaging Authority identifies a post-link vulnerability in virtualenv versions prior to 21.14.9. This vulnerability arises because the built-in creator calls ensuredir when handling executable files, libraries, and package directories; it accepts existing symbolic links pointing to...
SUSE CVE-2026-110923
CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552...
CVE-2026-110923
Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552...
AZL-108432 CVE-2026-110923 affecting package openssh 9.8p1-10
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected...
UBUNTU-CVE-2026-110923
Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552...
CVE-2026-110923
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected...
EUVD-2026-101835
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected...
CVE-2026-110923
A flaw exists in OpenSSH where a malicious server can manipulate sftp copy operations. By supplying an empty name, a slash-only path, or a ".." basename , the server can cause the sftp client to write files outside of the local directory selected by the user. This vulnerability affects the openss...
CVE-2026-110923
...
CVE-2026-110923
Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552...
CVE-2026-110923: Improper Limitation of a Pathname to a Restricted Directory
Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552...
PT-2026-122961
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected...
Linux Distros Unpatched Vulnerability : CVE-2026-110923
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash- only path, or a .. basename that sftp uses as the local...
CVE-2026-5049
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...
CVE-2026-5049: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...
CVE-2026-103648 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader
Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...
CVE-2026-103648 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader
Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...
CVE-2026-103648 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader
Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...