#cwe-59

共收录 498 条相关情报。

漏洞预警2026-08-24 发布INFO

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an ar...

CVE-2026-76845

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforc

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-22 发布INFO

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnera...

CVE-2026-70626

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-21 发布INFO

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live applica...

CVE-2026-55168

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-co

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-61

漏洞预警2026-08-21 发布INFO

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in in...

CVE-2026-71493

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, p

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-08-21 发布INFO

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOF...

CVE-2026-49114

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_da

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59 #cwe-367

安全公告2026-08-21 发布INFO

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which...

CVE-2026-77815

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59 #severity:high

漏洞预警2026-08-21 发布INFO

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside...

CVE-2026-77815

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-21 发布INFO

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_ima...

CVE-2026-63125

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-61

安全公告2026-08-21 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary...

CVE-2026-17171

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59 #severity:high

安全公告2026-08-21 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of...

CVE-2026-16980

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59 #severity:medium

安全公告2026-08-21 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated...

CVE-2026-16989

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper r

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59 #severity:high

漏洞预警2026-08-20 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links.

CVE-2026-17171

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-20 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symbolic links.

CVE-2026-16989

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper r

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-20 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbolic links.

CVE-2026-16980

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-20 发布INFO

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected insta...

CVE-2026-18267

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically pres

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-19 发布INFO

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random...

CVE-2026-55086

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/Exp

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-377

漏洞预警2026-08-19 发布INFO

Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local...

CVE-2026-56796

Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Link Resolution Before File Access ('Link Follow

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-19 发布INFO

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containin...

CVE-2026-47187

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can retu

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-18 发布INFO

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make i...

CVE-2026-47699

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

安全公告2026-08-18 发布INFO

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169...

CVE-2026-76037

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59