#cwe-59

共收录 498 条相关情报。

← 返回所有主题

漏洞预警2026-08-18 发布INFO

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox vi...

CVE-2026-76037

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

安全公告2026-08-18 发布INFO

moby/go-archive: Crafted tar archive can write outside the extraction directory

CVE-2026-17106

### Summary The tar extraction routines in `moby/go-archive` (`Unpack`, `UnpackLayer`, `Untar`/`UntarUncompressed`, and

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #cwe-59 #severity:high

漏洞预警2026-08-18 发布INFO

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination...

CVE-2026-17106

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

安全公告2026-08-17 发布INFO

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

CVE-2026-53766

### Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-22 #cwe-59 #severity:medium

安全公告2026-08-16 发布INFO

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during...

CVE-2026-74796

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attack

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59 #severity:high

漏洞预警2026-08-16 发布MEDIUM

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working di...

CVE-2026-74796

OpenTofu（Terraform 的开源替代品）在 1.11.7 之前版本中存在一个安全漏洞，该漏洞发生在初始化（tofu init）阶段。具体而言，OpenTofu 在初始化过程中未能正确验证 provider 缓存目录中已存在的符号

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-14 发布HIGH

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".

CVE-2026-69414

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicl

来源摘录 · NVD

#cve #cwe-269 #cwe-59

安全公告2026-08-14 发布INFO

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This...

CVE-2026-19909

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows networ

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59 #severity:high

漏洞预警2026-08-14 发布INFO

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affecte...

CVE-2026-19909

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows networ

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-13 发布INFO

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when...

CVE-2026-70460

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module roo

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-08-13 发布INFO

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file...

CVE-2026-63426

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-13 发布INFO

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as ...

CVE-2026-53803

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files b

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-13 发布INFO

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer f...

CVE-2026-53801

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-367

漏洞预警2026-08-13 发布INFO

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary fil...

CVE-2026-53800

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-367

漏洞预警2026-08-13 发布INFO

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files ...

CVE-2026-53799

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply a

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-367

漏洞预警2026-08-13 发布INFO

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the sou...

CVE-2026-53797

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-367

漏洞预警2026-08-13 发布INFO

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attac...

CVE-2026-53796

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon recei

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-367

漏洞预警2026-08-13 发布INFO

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via -...

CVE-2026-53795

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the inten

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-13 发布INFO

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that re...

CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended in

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-08-13 发布INFO

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative pat...

CVE-2026-53785

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the int

历史摘要 · 未重新核验 · NVD

#cve #cwe-59