File and Path Handling

Every one of the 39 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Horde/Horde Groupware - Local File InclusionCVE-2009-0932Debian · 48% likely

   CWE-22

2. Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with…CVE-2014-3865Debian · 7.3% likely

   CWE-22

3. Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files o…CVE-2009-4013Debian · 5.8% likely

   CWE-22

4. dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attac…CVE-2017-8283Debian · 4.7% likely

   CWE-22

5. directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tarCVE-2022-1664Debian · 3.2% likely

   CWE-22

6. Directory traversal vulnerability in dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via directory traversal sequence…CVE-2010-1679Debian · 3.1% likely

   CWE-22

7. Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror.CVE-2017-8805Debian · 3.0% likely

   CWE-22

8. Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary…CVE-2014-0471Debian · 2.9% likely

   CWE-22

9. dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via a symlink attack on unspecified files in the .pc directory.CVE-2011-0402Debian · 2.9% likely

   CWE-59

10. Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that la…CVE-2014-3864Debian · 2.8% likely

    CWE-22

11. dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers…CVE-2014-3127Debian · 2.1% likely

    CWE-22

12. Directory traversal vulnerability in the dpkg-source component in dpkg before 1.14.29 allows remote attackers to modify arbitrary files via a crafted Debian source archive.CVE-2010-0396Debian · 2.0% likely

    CWE-22

13. dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in…CVE-2014-3227Debian · 1.8% likely

    CWE-22

14. /bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to overwrite arbitrary files via a symlink attack o…CVE-2008-5394Debian · 0.9% likely

    CWE-59

15. APT RCE via hard link reuseCVE-2026-109518Debian · CVSS 7.7 · 0.9% likelycovered by CyberSIXT

    CWE-625 articles1 article this week: OpenSSH flaw allows passwordless logins on musl systems

16. Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstr…CVE-2023-7207Debian · CVSS 4.9 · 0.9% likely

    CWE-22

17. The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation during package installation.CVE-2012-1093Debian · 0.6% likely

    CWE-59

18. init in initramfs-tools 0.92f allows local users to overwrite arbitrary files via a symlink attack on the /tmp/initramfs.debug temporary file. NOTE: the vendor disputes this vulne…CVE-2008-4996Debian · CVSS 5.5 · 0.4% likely

    CWE-59

19. The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS be…CVE-2016-1255Debian · 0.4% likely

    CWE-59

20. mkmailpost in newsgate 1.6 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mmp##### temporary file.CVE-2008-4975Debian · 0.4% likely

    CWE-59

21. i2myspell in myspell 3.1 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/i2my#####.1 and (2) /tmp/i2my#####.2 temporary files.CVE-2008-4973Debian · 0.4% likely

    CWE-59

22. The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.CVE-2014-7206Debian · 0.4% likely

    CWE-59

23. os-prober in os-prober 1.17 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/mounted-map or (2) /tmp/raided-map temporary file. NOTE: the vendo…CVE-2008-5135Debian · 0.4% likely

    CWE-59

24. gccross in dpkg-cross 2.3.0 allows local users to overwrite arbitrary files via a symlink attack on the tmp/gccross2.log temporary file. NOTE: the vendor disputes this vulnerabili…CVE-2008-4950Debian · 0.4% likely

    CWE-59

25. aptlinex before 0.91 allows local users to overwrite arbitrary files via a symlink attack on the gambas-apt.lock temporary file.CVE-2008-1901Debian · 0.4% likely

    CWE-59

26. (1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and wr…CVE-2014-1638Debian · 0.4% likely

    CWE-59

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.