Arbitrary file deletion

Symantec Endpoint Protection SEP and Symantec Endpoint Protection Small Business Edition SEP SBE, prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to an arbitrary file write vulnerability, which is a type of issue whereby an attacker is able to overwrite existing...

CVE-2020-5825

CVE-2020-5825 affects Symantec Endpoint Protection (SEP) and SEP SBE prior to 14.2 RU2 MP1 (14.2.5569.2100). It is an arbitrary file write vulnerability allowing overwriting of existing files without proper privileges (local access). Remediation is to upgrade to SEP/SEP SBE 14.2 RU2 MP1 (14.2.556...

CVE-2020-5825: Undefined Security Weakness

Symantec Endpoint Protection SEP and Symantec Endpoint Protection Small Business Edition SEP SBE, prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to an arbitrary file write vulnerability, which is a type of issue whereby an attacker is able to overwrite existing...

PT-2020-18734

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions prior to 14.2 RU2 MP1 Symantec Endpoint Protection Small Business Edition versions prior to 14.2.5569.2100 Description The issue allows an attacker to overwrite existing files on the system without proper...

PT-2020-6016

Name of the Vulnerable Software and Affected Versions Adobe Acrobat versions prior to 2019.021.20061 Adobe Reader versions prior to 2019.021.20061 Adobe Acrobat versions prior to 2017.011.30156 Adobe Reader versions prior to 2017.011.30156 Adobe Acrobat versions prior to 2015.006.30508 Adobe Read...

CVE-2019-11482: Time-of-check Time-of-use (TOCTOU) Race Condition

Sander Bos discovered a time of check to time of use TOCTTOU vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories...

CVE-2020-5720

MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has write permissions. WinBox is vulnerable to this attack if it connects to a malicious endpoint or if an attacker mounts a man in the middle attack...

npm: Symlink reference outside of node_modules folder through the bin field upon installation

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenodemodules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package...

npm: Arbitrary file write via constructed entry in the package.json bin field

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended nodemodules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or ga...

CVE-2014-8741: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitrary files via unspecified vectors...

CVE-2014-1923

Multiple directory traversal vulnerabilities in the 1 staff interface help editor edithelp.pl or 2 member-picupload.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow remote attackers to write to arbitrary files via unspecified vectors...

CVE-2014-1923: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the 1 staff interface help editor edithelp.pl or 2 member-picupload.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow remote attackers to write to arbitrary files via unspecified vectors...

PT-2020-7612

Name of the Vulnerable Software and Affected Versions Koha versions prior to 3.8.23 Koha versions 3.10.x prior to 3.10.13 Koha versions 3.12.x prior to 3.12.10 Koha versions 3.14.x prior to 3.14.3 Description The issue allows remote attackers to write to arbitrary files via unspecified vectors du...

PT-2020-18317

Name of the Vulnerable Software and Affected Versions uftpd versions prior to 2.11 Description The issue allows an unauthenticated user to perform a directory traversal attack using multiple different FTP commands, enabling them to read and write to arbitrary locations on the filesystem. This is...

CVE-2014-5007: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. dot dot in the filename...

CVE-2015-3147: Improper Link Resolution Before File Access

daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool ABRT, when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on 1 /var/spool/abrt or 2 /var/tmp/abrt...

CVE-2019-16776

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended nodemodules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or ga...

Yandex ClickHouse Arbitrary File Write Vulnerability

Yandex ClickHouse is a set of open source columnar databases for online analytical processing of the Russian company Yandex. A security vulnerability exists in Yandex ClickHouse versions prior to 19.14.3. An attacker can exploit this vulnerability to cause clickhouse-server to perform a write...

Design/Logic Flaw

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When...

CVE-2019-15024

CVE-2019-15024 affects ClickHouse before 19.14.3. An attacker with write access to ZooKeeper who can run a network-accessible custom server can register a malicious replica in ZooKeeper. When another replica fetches a data part from this server, clickhouse-server can be forced to write to an arbi...