CVE-2022-37865

CVE-2022-37865 affects Apache Ivy when using packaging types zip/jar/war with an unpacking on-the-fly feature introduced in Ivy 2.4.0. The vulnerability arises from Ivy’s archive extraction not validating target paths, allowing an archive containing absolute paths or paths using .. to write files...

CVE-2022-37865

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracting the archive. A...

SolarWinds Orion Arbitrary File Write (CVE-2020-27871)

An arbitrary file write vulnerability exists in SolarWinds Network Configuration Manager. The vulnerability is due to insufficient validation of file types for vulnerability announcement data files in VulnerabilitySettings.aspx, combined with a lack of restriction on destination paths. A remote,...

CVE-2022-38582

Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files...

Watchdog Antivirus 安全漏洞

Watchdog Antivirus is an anti-malware program from Watchdog. Designed to neutralize viruses, trojans, rootkits, worms, spyware and adware. A security vulnerability exists in Watchdog Antivirus version v1.4.158, which stems from incorrect access control in the anti-virus driver wsdkd.sys, allowing...

PT-2022-24470 · Unknown · Watchdog Anti-Virus

Name of the Vulnerable Software and Affected Versions: Watchdog Antivirus version 1.4.158 Description: The issue is related to incorrect access control in the anti-virus driver wsdkd.sys, which allows attackers to write arbitrary files. Recommendations: For Watchdog Antivirus version 1.4.158,...

CVE-2022-38582: Out-of-bounds Write

Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files...

Amazon Linux 2022 : xz, xz-devel, xz-libs (ALAS2022-2022-187)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-187 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...

Amazon Linux 2022 : gzip (ALAS2022-2022-188)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-188 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...

CVE-2022-39367: Improper Limitation of a Pathname to a Restricted Directory

QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packages as ZIP files. The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, so can insert files int...

CVE-2022-20955

The CVE-2022-20955 issue affects Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software. The root cause is improper access controls on local file system assets and the CLI, enabling authenticated, local attackers to overwrite arbitrary files via symbolic links and to pe...

CVE-2022-20954 Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities

Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the...

CVE-2022-43748: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files via unspecified vectors...

CVE-2022-20953: Exposure of Sensitive Information to an Unauthorized Actor

Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the...

CVE-2022-20954: Exposure of Sensitive Information to an Unauthorized Actor

Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the...

CVE-2022-20955: Exposure of Sensitive Information to an Unauthorized Actor

Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the...

CVE-2022-20811: Exposure of Sensitive Information to an Unauthorized Actor

Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the...

CVE-2022-27623: Missing Authentication for Critical Function

Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote attackers to read or write arbitrary files via unspecified vectors...

PT-2022-27972

Name of the Vulnerable Software and Affected Versions macOS versions prior to 12.6.1 macOS Big Sur versions prior to 11.7.1 Description A remote user may be able to write arbitrary files. This issue enables attackers to overwrite or delete files within the Calendar app’s filesystem. Recommendatio...

CVE-2022-20776

Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the...