#cwe-22

共收录 2626 条相关情报。

漏洞预警2026-09-22 发布INFO

Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulner...

CVE-2026-80155

Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB88

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confi...

CVE-2026-77621

Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

安全公告2026-09-22 发布INFO

Vector: Arbitrary file write in the file sink via templated path (path traversal).

CVE-2026-77621

Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-73

漏洞预警2026-09-22 发布INFO

In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organizatio...

CVE-2026-95701

In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path co

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file exte...

CVE-2026-95698

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organizatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied...

CVE-2026-95693

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(),

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200

安全公告2026-09-22 发布INFO

MISP Path Traversal via Organization Name in Org-Statistics Logo Check

CVE-2026-95701

In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path co

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-09-22 发布INFO

MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name

CVE-2026-95698

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organizatio

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-09-22 发布INFO

MISP Information Disclosure via Forged Upload Path

CVE-2026-95693

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(),

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-22

漏洞预警2026-09-22 发布INFO

The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install...

CVE-2026-95667

The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_ins

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-732

漏洞预警2026-09-22 发布INFO

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the component ...

CVE-2026-95273

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the file changedetectionio/flask_app.py of the component Scree...

CVE-2026-95272

A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function static_content of the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

CVE-2026-93616

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary s

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-22 发布INFO

MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

CVE-2026-95667

The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_ins

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-732

漏洞预警2026-09-22 发布INFO

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an...

CVE-2026-15095

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vu

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_e...

CVE-2025-1281

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valid

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() functio...

CVE-2025-1280

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-22 发布INFO

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path o...

CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-22 发布INFO

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

漏洞预警2026-09-22 发布INFO

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function _validate of the file src/octoprint/server/api/files.py of the component File D...

CVE-2026-94489

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function _validate of the file

历史摘要 · 未重新核验 · NVD

#cve #cwe-22