#cwe-59

共收录 498 条相关情报。

← 返回所有主题

漏洞预警2026-10-31 发布MEDIUM

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread...

CVE-2026-118599

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webexte

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-59 #severity:medium

漏洞预警2026-10-30 发布HIGH

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatechec...

CVE-2026-119336

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From

来源摘录 · NVD

#cve #cwe-59 #cwe-61

漏洞预警2026-10-30 发布LOW

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability wit...

CVE-2026-119334

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布HIGH

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it ...

CVE-2026-116250

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permissio

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-367 #cwe-59 #severity:high

漏洞预警2026-10-30 发布MEDIUM

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside...

CVE-2026-119704

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allow

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布MEDIUM

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, wri...

CVE-2026-119291

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect s

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite...

CVE-2026-118990

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when takin

来源摘录 · NVD

#cve #cwe-379 #cwe-59

漏洞预警2026-10-29 发布HIGH

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions a...

CVE-2026-119168

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration th

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-29 发布HIGH

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outs...

CVE-2026-107347

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes

来源摘录 · NVD

#cve #cwe-59

安全公告2026-10-29 发布HIGH

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

CVE-2026-115908

### Summary - **Verified version:** zip `9.0.0-pre3` - **Affected versions:** `7.2.0` and later - **Precondition:** The

来源摘录 · GitHub Advisory

#advisory #cwe-22 #cwe-59 #cwe-61 #rust #severity:high

漏洞预警2026-10-29 发布HIGH

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deploym...

CVE-2026-115713

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to un

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-29 发布HIGH

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other...

CVE-2026-115709

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to un

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-29 发布HIGH

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the confi...

CVE-2026-115708

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to au

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-28 发布INFO

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each mess...

CVE-2026-116271

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, l

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-28 发布HIGH

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session S...

CVE-2026-103401

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handle

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-28 发布HIGH

Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privi...

CVE-2026-6064

Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security

来源摘录 · NVD

#cve #cwe-59

安全公告2026-10-27 发布INFO

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

CVE-2026-116682

## Summary File read paths resolve symbolic links with `filepath.EvalSymlinks` and then operate on the resolved target

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #cwe-59 #severity:high

漏洞预警2026-10-27 发布HIGH

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves sy...

CVE-2026-116682

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read hand

来源摘录 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-10-27 发布INFO

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

CVE-2026-108332

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-27 发布INFO

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

CVE-2026-108306

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

历史摘要 · 未重新核验 · NVD

#cve #cwe-59