#cwe-59

共收录 498 条相关情报。

漏洞预警2026-07-17 发布INFO

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but ...

CVE-2026-50163

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 vali

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-07-16 发布INFO

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the s...

CVE-2026-53535

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-conf

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

安全公告2026-07-16 发布INFO

Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

CVE-2026-53535

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-conf

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-59

漏洞预警2026-07-16 发布INFO

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility cr...

CVE-2026-12391

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) with

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

安全公告2026-07-15 发布INFO

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on...

CVE-2026-61371

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59 #severity:high

漏洞预警2026-07-15 发布INFO

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect i...

CVE-2026-61371

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-07-15 发布LOW

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows read...

CVE-2026-61859

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operatio

来源摘录 · NVD

#cve #cwe-59

安全公告2026-07-15 发布INFO

ImageMagick before 7.1.2-26 Policy Bypass via script operation

CVE-2026-61859

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operatio

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-59

漏洞预警2026-07-14 发布INFO

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rc...

CVE-2026-54572

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

安全公告2026-07-14 发布INFO

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

CVE-2026-54572

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-59

漏洞预警2026-07-14 发布INFO

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an ...

CVE-2026-53486

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files an

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59 #cwe-732

漏洞预警2026-07-14 发布MEDIUM

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

CVE-2026-50526

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tamperin

来源摘录 · NVD

#cve #cwe-345 #cwe-59

安全公告2026-07-14 发布INFO

decompress: Archive extraction can create files and links outside the target directory

CVE-2026-53486

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files an

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-59 #cwe-732

漏洞预警2026-07-14 发布INFO

Improper link resolution before file access ('link following') in Windows Projected File System allows an authorized attacker to elevate privileges locally.

CVE-2026-50469

Improper link resolution before file access ('link following') in Windows Projected File System allows an authorized att

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-07-14 发布INFO

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-50438

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-07-14 发布INFO

Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

CVE-2026-49791

Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-07-14 发布INFO

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

CVE-2026-49176

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-269

漏洞预警2026-07-14 发布INFO

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file p...

CVE-2026-15392

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The co

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

安全公告2026-07-14 发布INFO

A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file...

CVE-2026-15621

A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file o

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59 #severity:medium

漏洞预警2026-07-14 发布INFO

A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file of the file tools/fs_ops.go of the component File Tools. P...

CVE-2026-15621

A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file o

历史摘要 · 未重新核验 · NVD

#cve #cwe-59