Cursor 路径遍历漏洞

Cursor is an AI code editor from the Cursor open source. A path traversal vulnerability exists in Cursor versions 0.45.0 through 0.48.6, which stems from not properly restricting file path modification permissions, which could lead to a specially crafted context-triggered write to a file outside...

tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. For the vulnerability to be...

CVE-2024-45551 Weak Authentication in HLOS

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass...

The vulnerability of the Synology BeeStation Manager (BSM), Synology DiskStation Manager (DSM), and Synology BeeStation OS lies in errors related to the certificate validation process. This allows attackers to create a limited number of arbitrary files.

The vulnerability of the Synology BeeStation Manager BSM, Synology DiskStation Manager DSM, and Synology BeeStation OS is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to write a limited number of arbitrary files...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition due to concurrent writes to a map by logger.go. An attacker can induce a read-write conflict and cause repeated restarts and then a panic by writing to multiple logs simultaneously. Remediation There is no fixed version f...

CVE-2024-58133

In chainmaker-go aka ChainMaker before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by logger.go to a map are mishandled. Creating other logs simultaneously can lead to a read-write conflict and panic...

CVE-2024-58133

CVE-2024-58133 affects chainmaker-go (ChainMaker) before version 2.4.0. The root cause is concurrent writes to a map performed by logger.go during frequent updates to a node’s configuration file and subsequent restart, which can cause a read-write conflict and panic. Public sources explicitly des...

PT-2025-15082 · Unknown · Chainmaker

Name of the Vulnerable Software and Affected Versions: ChainMaker versions prior to 2.4.0 Description: The issue arises from concurrent writes to a map by logger.go when a node's configuration file is frequently updated and the node is restarted. This can lead to a read-write conflict, resulting ...

CVE-2024-58133

In chainmaker-go aka ChainMaker before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by logger.go to a map are mishandled. Creating other logs simultaneously can lead to a read-write conflict and panic...

Directory Traversal

Overview zip-lib is a zip and unzip library for node Affected versions of this package are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended...

chainMaker 安全漏洞

chainMaker is a Go library in the Go open source. A security vulnerability exists in chainMaker versions prior to 2.4.0, which stems from logger.go mishandling concurrent writes to mappings, which can lead to read/write conflicts and crashes...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero CVE-2024-26982 In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm-srcu when handling KVMSETVCPUEVENTS...

Important: tomcat9

Issue Overview: Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from...

GHSA-PQ67-2WWV-3XJX tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

An Improper Link Resolution Before File Access "Link Following" and Improper Limitation of a Pathname to a Restricted Directory "Path Traversal". This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intend...

UBUNTU-CVE-2024-12905

An Improper Link Resolution Before File Access "Link Following" and Improper Limitation of a Pathname to a Restricted Directory "Path Traversal". This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intend...

Denial Of Service (DoS)

ai.h2o, h2o-ext-xgboost is vulnerable to Denial Of Service DoS . The vulnerability is due to improper exposure of internal classes through the ast parser in the runtool command, allows attackers to exploit the XGBoostLibExtractTool class to perform arbitrary file writes and shut down the server...

LibreChat Path Traversal Vulnerability

LibreChat is an enhanced ChatGPT clone. LibreChat suffers from a path traversal vulnerability that stems from the program failing to properly filter special elements in the path of a resource or file, which can be exploited by an attacker to cause arbitrary file writes and remote code execution...

GPT Academic path traversal vulnerability (CNVD-2025-22739)

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a path traversal vulnerability that stems from an unverified 7z file extraction, which can be exploited by an attacker to perform arbitrary file writes, leadi...

CVE-2024-12389

A path traversal vulnerability exists in binary-husky/gptacademic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction...

External Control of File Name or Path

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to External Control of File Name or Path via the restorerunbackup function. An attacker can write arbitrary data to arbitrary locations on the host server by controlling...