PT-2020-4619

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software affected versions not specified Description The issue is related to improper validation of requests to APIs within the application data endpoints, allowing an authenticated, remote attacker to write arbitrary file...

Nagios XI Command Injection Vulnerability (CNVD-2020-58771)

Nagios XI and Nagios are both products of Nagios, Inc.Nagios XI is an IT infrastructure monitoring solution. The solution supports monitoring and alerting of applications, services, operating systems, etc. Nagios is an open source, free network monitoring tool. A security vulnerability exists in...

CVE-2020-5792

Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user...

CVE-2020-5792: Improper Neutralization of Argument Delimiters in a Command

Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user...

PT-2020-18713

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.7.3 Description The issue is related to the improper neutralization of argument delimiters in a command, allowing a remote, authenticated admin user to write to arbitrary files. This can ultimately lead to code execution wi...

USN-4588-1 flightgear vulnerability

It was discovered that FlightGear could write arbitrary files if received a special nasal script. A remote attacker could exploit this with a crafted file to execute arbitrary code...

File upload vulnerability in TWCMS backend se***_co***.cl***.php file

TWCMS Tong Wang CMS is an enterprise website CMS system. A file upload vulnerability exists in the seco.cl.php file in the background of TWCMS. An attacker can exploit the vulnerability to write arbitrary files and gain server privileges...

CVE-2020-21526

An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it...

CVE-2020-15731

An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448...

CVE-2020-15731: Improper Input Validation

An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448...

PT-2020-14612

Name of the Vulnerable Software and Affected Versions Bitdefender Engines versions prior to 7.85448 Description An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded i...

Ozeki NG SMS Gateway Path Traversal Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A path traversal vulnerability exists in the "Script Name" of the "Autoresponder" module in Ozeki NG SMS Gateway 4.17.6 and earlier. The vulnerability can be exploited to write or overwrite arbitrary files with...

CVE-2020-14028

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. By leveraging a path traversal vulnerability in the Autoreply module's Script Name, an attacker may write to or overwrite arbitrary files, with arbitrary content, usually with NT AUTHORITY\SYSTEM privileges...

CVE-2020-14028: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. By leveraging a path traversal vulnerability in the Autoreply module's Script Name, an attacker may write to or overwrite arbitrary files, with arbitrary content, usually with NT AUTHORITY\SYSTEM privileges...

USN-4518-1 xawtv vulnerability

Matthias Gerstner discovered that xawtv incorrectly handled opening files. A local attacker could possibly use this issue to open and write to arbitrary files and escalate privileges. CVE-2020-13696...

Arbitrary file write vulnerability in Storable Configs

Storable Configs allows storing copies of a job's config.xml file on the Jenkins controller with a user-specified file name. Storable Configs 1.0 and earlier does not restrict the user-specified file name, except that a .xml suffix is added if it's not already present. This allows attackers with...

CVE-2020-25289

The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directory which has weak permissions...

CVE-2020-25289: Improper Link Resolution Before File Access

The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directory which has weak permissions...

CVE-2020-25247: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. Directory traversal exists for writing to files, as demonstrated by the FileName parameter...

CVE-2020-25257: Improper Restriction of XML External Entity Reference

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows XXE attacks for read/write access to arbitrary files...