#cwe-36

共收录 36 条相关情报。

漏洞预警2026-10-28 发布MEDIUM

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML...

CVE-2026-118693

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trus

来源摘录 · NVD

#cve #cwe-36

漏洞预警2026-10-13 发布HIGH

Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.

CVE-2026-83784

Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over

来源摘录 · NVD

#cve #cwe-36

漏洞预警2026-10-13 发布MEDIUM

Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.

CVE-2026-83683

Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information ov

来源摘录 · NVD

#cve #cwe-36

漏洞预警2026-09-17 发布INFO

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with ...

CVE-2026-55062

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23 #cwe-36 #cwe-73

安全公告2026-09-17 发布INFO

uniget: Path Traversal in Hook Files - Directory Escape Vulnerability

CVE-2026-55062

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-23 #cwe-36 #cwe-73

漏洞预警2026-09-11 发布CRITICAL

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwri...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file wr

来源摘录 · NVD

#cve #cwe-36

安全公告2026-09-11 发布INFO

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain...

CVE-2026-82092

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-36 #severity:high

漏洞预警2026-09-10 发布INFO

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.

CVE-2026-82092

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-09-10 发布INFO

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

CVE-2026-68487

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-09-10 发布INFO

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to...

CVE-2026-88288

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with va

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-09-08 发布INFO

Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVE-2026-68896

Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locall

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-08-18 发布INFO

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution.

CVE-2026-47630

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path travers

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-08-18 发布INFO

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and...

CVE-2026-47606

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path travers

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

安全公告2026-08-17 发布INFO

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

CVE-2026-55062

### Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary f

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #cwe-23 #cwe-36 #cwe-73

漏洞预警2026-08-07 发布CRITICAL

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3.31.0, the runtime-...

CVE-2026-47243

CVE-2026-47243 是 Kata Containers 项目中一个影响 runtime-rs standalone virtio-fs 路径的严重漏洞，源于该配置下宿主机的 virtiofsd 进程以 root 权限运行，并且使用

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-36

漏洞预警2026-08-07 发布INFO

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled an...

CVE-2026-54202

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation funct

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-07-29 发布INFO

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vul...

CVE-2026-13346

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-07-22 发布INFO

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-si...

CVE-2026-13189

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell c

历史摘要 · 未重新核验 · NVD

#cve #cwe-36

漏洞预警2026-07-10 发布INFO

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded...

CVE-2026-57211

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin stati

历史摘要 · 未重新核验 · NVD

#cve #cwe-36 #cwe-918

漏洞预警2026-07-10 发布INFO

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for ...

CVE-2026-15302

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via

历史摘要 · 未重新核验 · NVD

#cve #cwe-36