CVE-2022-39286 Execution with Unnecessary Privileges in JupyterApp

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupytercore that stems from jupytercore executing untrusted files in CWD. This vulnerability allows one user to run code as...

CVE-2022-39286

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupytercore that stems from jupytercore executing untrusted files in CWD. This vulnerability allows one user to run code as...

CVE-2021-41636

MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply...

Design/Logic Flaw

MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply...

CVE-2021-41636

MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply...

CVE-2021-41636: Improper Limitation of a Pathname to a Restricted Directory

MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply...

Updated firejail packages fix security vulnerability

private-cwd leaks access to the entire filesystem...

Execution with Unnecessary Privileges in ipython

We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another. Proof of concept User1: mkdir -m 777 /tmp/profiledefault mkdir -m 777 /tmp/profiledefault/startup echo...

FreeBSD -- jail_attach(2) relies on the caller to change the cwd

Problem Description: When a process, such as jexec8 or killall1, calls jailattach2 to enter a jail, the jailed root can attach to it using ptrace2 before the current working directory is changed. Impact: A process with superuser privileges running inside a jail could change the root directory...

CVE-2020-26299: Improper Limitation of a Pathname to a Restricted Directory

ftp-srv is an open-source FTP server designed to be simple yet configurable. In ftp-srv before version 4.4.0 there is a path-traversal vulnerability. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands,...

Malicious Package in load-from-cwd-or-npm

Version 3.0.2 of load-from-cwd-or-npm contains malicious code. The malware breaks functionality of the purescript-installer package by injecting targeted code. Recommendation Upgrade to version 3.0.4 or later. There is no indication of further compromise...

CVE-2020-14149: NULL Pointer Dereference

In uftpd before 2.12, handleCWD in ftpcmd.c mishandled the path provided by the user, causing a NULL pointer dereference and denial of service, as demonstrated by a CWD /.. command...

procps-ng security and bug fix update

3.3.10-26 - free: unreclaimable slabs counted into free memory, used mem incorrect - Resolves: rhbz1699264 3.3.10-25 - ps: recognize SCHEDDEADLINE in CLS field, upstream backport - Resolves: rhbz1692843 3.3.10-24 - top: Do not default to the cwd in configsread - Resolves: rhbz1577023...

CVE-2018-7838

A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FT...

CVE-2018-7838: Improper Restriction of Operations within the Bounds of a Memory Buffer

A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FT...

CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

CVE-2019-11503

CVE-2019-11503 concerns the snap-confine component included in snapd before 2.39, where a symlink race during a chdir() to the caller’s CWD could enable a cwd restore permission bypass. The vulnerability is documented in multiple sources (NVD, OSV) with the same description. The risk context indi...

CVE-2019-11503: Improper Link Resolution Before File Access

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

VulnCheck KEV: CVE-2001-0550

wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "" argument to commands such as CWD, which is not properly handled by the glob function ftpglob...

UBUNTU-CVE-2016-6289

Integer overflow in the virtualfileex function in TSRM/tsrmvirtualcwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service stack-based buffer overflow or possibly have unspecified other impact via a crafted extract operation on a Z...