PT-2019-6551

Name of the Vulnerable Software and Affected Versions IcedTea6 versions prior to 1.7.4 Description The issue allows unsigned applications to read and write arbitrary files due to a problem related to Extended JNLP Services. Recommendations For versions prior to 1.7.4, update to version 1.7.4 or...

CVE-2010-0398

The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack...

DEBIAN-CVE-2010-0398

The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack...

kubernetes: `kubectl cp` allows for arbitrary file write via double symlinks

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be...

PT-2019-6527

Name of the Vulnerable Software and Affected Versions autokey versions prior to 0.61.3-2 Description The issue allows local attackers to write to arbitrary files via a symlink attack. This is a result of a flaw in the init script of the affected software. Recommendations For versions prior to...

CVE-2010-0398: Improper Link Resolution Before File Access

The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack...

CVE-2010-2064

rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on 1 /tmp/portmap.xdr and 2 /tmp/rpcbind.xdr...

CVE-2010-2064: Improper Link Resolution Before File Access

rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on 1 /tmp/portmap.xdr and 2 /tmp/rpcbind.xdr...

PT-2019-6535

Name of the Vulnerable Software and Affected Versions rpcbind version 0.2.0 Description The issue allows local users to write to arbitrary files or gain privileges via a symlink attack on 1 /tmp/portmap.xdr and 2 /tmp/rpcbind.xdr. Recommendations For rpcbind version 0.2.0, consider restricting...

The vulnerability of the centralized service for supporting information about configuration, naming, distributed synchronization, and providing group services in Apache ZooKeeper makes it possible for a attacker to write arbitrary files to the operating system of the vulnerable device.

The vulnerability of the centralized service for supporting information about configuration, naming, distributed synchronization, and providing group services in Apache ZooKeeper exists due to the lack of authentication when joining a quorum. Exploiting this vulnerability allows an attacker to...

The numerous vulnerabilities in the API interface of the WADashboard component of the Advantech WebAccess software allow a perpetrator to write or overwrite any files in the file system.

The multiple vulnerabilities of the API interface of the WADashboard component in the Advantech WebAccess remote monitoring software are related to deficiencies in path validation before its use in file operations. Exploiting these vulnerabilities could allow a malicious actor to read arbitrary...

Samba CVE-2019-10218 Path Traversal Arbitrary File Write Vulnerability

Description Samba is prone to an arbitrary file write vulnerability. Successful exploits may allow an attacker to write arbitrary files to the affected system. This may aid in further attacks. Technologies Affected Samba Samba 3.4.0 Samba Samba 3.4.1 Samba Samba 3.4.10 Samba Samba 3.4.11 Samba...

Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability (CNVD-2019-37414)

Cisco TelePresence is a Cisco TelePresence solution. A security vulnerability exists in Cisco TelePresence Collaboration Endpoint CE versions prior to 9.8.1 due to an improperly implemented privilege. An attacker can exploit the vulnerability to overwrite arbitrary files by logging in and...

Cisco TelePresence Collaboration Endpoint Software Arbitrary File Write Vulnerability

Cisco TelePresence is a Cisco TelePresence solution. A security vulnerability exists in Cisco TelePresence Collaboration Endpoint CE versions prior to 9.8.1 due to an improperly assigned privilege. The vulnerability can be exploited by an attacker to write to files in the /root directory by loggi...

Red Hat XML Language Support XML Language Server Path Traversal Vulnerability

Red Hat XML Language Support vscode-xml is the United States Red Hat Red Hat a support for the creation and editing of XML documents Visual Studio Code extensions. XML Language Server is used in one of the XML language server. A path traversal vulnerability exists in the XMLLanguageService.java...

CVE-2019-18212: Improper Limitation of a Pathname to a Restricted Directory

XMLLanguageService.java in XML Language Server aka lsp4xml before 0.9.1, as used in Red Hat XML Language Support aka vscode-xml before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal...

cPanel Injection Vulnerability (CNVD-2019-36138)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An injection vulnerability exists in cPanel versions prior to 11.54.0.4. The vulnerability stems from a lack of proper validation...

Cisco TelePresence CE Software CVE-2019-15962 Local Arbitrary File Write Vulnerability

Description Cisco TelePresence Collaboration Endpoint Software is prone to a local arbitrary file-write vulnerability. Successful exploits may allow an attacker to write arbitrary files on the root directory. This issue is being tracked by Cisco Bug ID CSCvq47315. Technologies Affected Cisco...

Arbitrary File Write

Overview Versions of decompress prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing../. Recommendation Upgrade to version 4.2.1 or...

Directory Traversal

Overview iobroker.admin is an User interface for configuration and administration of ioBroker. Affected versions of this package are vulnerable to Directory Traversal. An attacker can include file contents from outside the /log/file1/ directory. Note: The attacker has to be logged in if the...