#cwe-22

共收录 2656 条相关情报。

漏洞预警2026-09-04 发布INFO

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.

CVE-2026-67397

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-03 发布INFO

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. A...

CVE-2026-85456

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-03 发布INFO

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequ...

CVE-2026-82521

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-03 发布INFO

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

CVE-2026-69086

**CVE:** This vulnerability corresponds to [CVE-2026-69086](https://nvd.nist.gov/vuln/detail/CVE-2026-69086). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #severity:high

漏洞预警2026-09-03 发布INFO

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trail...

CVE-2026-85396

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly valida

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-03 发布INFO

rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

CVE-2026-85396

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly valida

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

漏洞预警2026-09-03 发布INFO

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: "SimpleHttp" acc...

CVE-2026-75602

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

安全公告2026-09-03 发布INFO

OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

CVE-2026-75602

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-73

漏洞预警2026-09-03 发布INFO

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Se...

CVE-2026-85199

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-co

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23 #cwe-206

漏洞预警2026-09-03 发布INFO

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The pla...

CVE-2026-85124

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments b

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-02 发布INFO

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

CVE-2026-63490

### Summary `com.github.jknack.handlebars.springmvc.SpringTemplateLoader` resolves Spring MVC view names into URLs via S

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #maven #cwe-22 #cwe-23 #cwe-552 #severity:high

安全公告2026-09-02 发布INFO

Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

CVE-2026-62677

### Summary An authenticated, non-admin user can obtain **arbitrary host-filesystem read/write** (and host environment-

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-22 #severity:high

安全公告2026-09-02 发布INFO

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The...

CVE-2026-84852

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the f

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:low

漏洞预警2026-09-02 发布INFO

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File...

CVE-2026-84852

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-02 发布INFO

Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary...

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

安全公告2026-09-02 发布INFO

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with...

CVE-2026-84669

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

安全公告2026-09-02 发布INFO

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration...

CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data bi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

漏洞预警2026-09-02 发布INFO

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc...

CVE-2026-49833

DSpace open source software is a repository application which provides durable access to digital resources. From version

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-02 发布INFO

DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task featur...

CVE-2026-49831

DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-02 发布INFO

DSpace: Path Traversal possible in LDN message generation

CVE-2026-49833

DSpace open source software is a repository application which provides durable access to digital resources. From version

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22