Cyber Security Daily Radar

#cwe-22

共收录 2626 条相关情报。

← 返回所有主题
漏洞预警2026-09-15 发布INFO

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary...

CVE-2026-91934

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite datab

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-15 发布INFO

A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unau...

CVE-2026-87791

A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Des

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-15 发布INFO

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-...

CVE-2026-55828

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses stric

历史摘要 · 未重新核验 · NVD

#cve#cwe-22#cwe-59
漏洞预警2026-09-15 发布INFO

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require...

CVE-2026-54077

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/quer

历史摘要 · 未重新核验 · NVD

#cve#cwe-22#cwe-776#cwe-918
漏洞预警2026-09-15 发布INFO

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD...

CVE-2026-50024

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_ta

历史摘要 · 未重新核验 · NVD

#cve#cwe-22#cwe-23
漏洞预警2026-09-15 发布INFO

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the sin...

CVE-2026-47215

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-15 发布INFO

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files ou...

CVE-2026-91751

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-14 发布INFO

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entrie...

CVE-2026-91200

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attack

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-14 发布INFO

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control o...

CVE-2026-84568

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS S

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-14 发布INFO

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, ma...

CVE-2026-84534

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 an

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-14 发布INFO

A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may...

CVE-2026-64756

A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-14 发布INFO

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root ...

CVE-2026-43691

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-14 发布INFO

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader throug...

CVE-2026-54629

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtu

历史摘要 · 未重新核验 · NVD

#cve#cwe-22#cwe-73#cwe-284#cwe-552#cwe-862
漏洞预警2026-09-14 发布INFO

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without rest...

CVE-2026-50006

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL fro

历史摘要 · 未重新核验 · NVD

#cve#cwe-22#cwe-73#cwe-284#cwe-434#cwe-862
漏洞预警2026-09-14 发布INFO

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.

CVE-2026-15955

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file writ

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
安全公告2026-09-12 发布INFO

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19...

CVE-2026-85706

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 1

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-22#severity:critical
漏洞预警2026-09-12 发布CRITICAL

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unau...

CVE-2026-85706

GitLab 官方披露并修复了编号为 CVE-2026-85706 的安全缺陷，该问题影响 GitLab CE 与 EE 的多个版本分支：从 18.7 开始至 19.1.8 之前、19.2 至 19.2.6 之前，以及 19.3 至 19.

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
安全公告2026-09-12 发布INFO

An interface that accepts file uploads from authenticated users extracts the contents of uploaded...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without valid

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-22#severity:high
漏洞预警2026-09-11 发布INFO

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intende...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without valid

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-09-11 发布INFO

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more seg...

CVE-2026-49846

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP re

历史摘要 · 未重新核验 · NVD

#cve#cwe-22#cwe-697