CVE-2020-5405 Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CVE-2020-5405

Spring Cloud Config - Local File Inclusion (CVE-2020-5405): Affects Spring Cloud Config Server in 2.2.x before 2.2.2 and 2.1.x before 2.1.7 (older/unsupported). Exploitable via a crafted URL to serve arbitrary configuration files, enabling potential data exposure. Remediation: upgrade to patched ...

PT-2020-18461

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 2.2.x prior to 2.2.2 Spring Cloud Config versions 2.1.x prior to 2.1.7 Spring Cloud Config older unsupported versions Description The issue allows applications to serve arbitrary configuration files through the...

CVE-2020-5405: Relative Path Traversal

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

[SECURITY] Fedora 31 Update: PyYAML-5.3-2.fc31

YAML is a data serialization format designed for human readability and interaction with scripting languages. PyYAML is a YAML parser and emitter for Python. PyYAML features a complete YAML 1.1 parser, Unicode support, pickle support, capable extension API, and sensible error messages. PyYAML...

Design/Logic Flaw

An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1. Loading a maliciously crafted racoon configuration file may lead to...

CVE-2020-3840

CVE-2020-3840 describes an off-by-one error in the handling of racoon configuration files within IPSec-related components. The underlying issue arises from improper bounds checking, which could allow a maliciously crafted racoon config to trigger arbitrary code execution. Apple and Red Hat record...

CVE-2019-18238

In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is stored in configuration files without encryption, which may allow an attacker to access an administrative account...

CVE-2020-6968

Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files...

CVE-2020-6968

Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files...

Code injection

Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files...

CVE-2020-6968

Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files...

CVE-2020-6968: Improper Privilege Management

Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files...

PT-2020-19316

Name of the Vulnerable Software and Affected Versions Honeywell INNCOM INNControl 3 affected versions not specified Description The issue allows workstation users to escalate application user privileges. This is achieved through the modification of local configuration files. Recommendations At th...

SUSE-SU-2020:0406-1 Security update for sudo

This update for sudo fixes the following issues: Security issue fixed: - CVE-2019-18634: Fixed a buffer overflow in the passphrase prompt that could occur when pwfeedback was enabled in /etc/sudoers bsc1162202. Non-security issue fixed: - Fixed an issue where sudo -l would ask for a password even...

Honeywell INNCOM INNControl 3 Privilege Mismanagement Vulnerability

Honeywell INNCOM INNControl 3 is an energy management and room control system from Honeywell USA. A security vulnerability exists in Honeywell INNCOM INNControl 3 version 3.21 and prior. An attacker can exploit the vulnerability to elevate user privileges by modifying local configuration files...

AFLplusplus

This is a code repository for AFLplusplus, a tool for fuzz testing and vulnerability discovery. The repository contains various files and directories related to the project, including configuration files, makefiles, and documentation. The repository is organized as follows: .clang-format is a...

CVE-2019-6193

An information disclosure vulnerability was reported in Lenovo XClarity Administrator LXCA versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames, license keys, IP addresses, and encrypted password hashes...

CVE-2019-6193

An information disclosure vulnerability was reported in Lenovo XClarity Administrator LXCA versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames, license keys, IP addresses, and encrypted password hashes...

CVE-2020-1931

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration .cf files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian...