DEBIAN-CVE-2022-26386

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in /tmp, but this behavior was changed to download them to /tmp where they could be affected by other local users. This behavior was reverted to the original, user-specific directory. This bug only...

SCIFIO 路径遍历漏洞

SCIFIO is SCIFIO open source an extensible Java framework. Used to read and write images, especially N-dimensional scientific images. A path traversal vulnerability exists in SCIFIO. An attacker could use this vulnerability to perform incorrect operations to obtain sensitive information in file...

MCPMappingViewer 路径遍历漏洞

MCPMappingViewer is a small GUI for viewing the mapping from Minecraft obfuscated code names to MCP code names. A path traversal vulnerability exists in MCPMappingViewer. An attacker could use this vulnerability to perform incorrect operations to obtain sensitive information in file directories...

PT-2022-19705 · Google · Android Google Search App

Name of the Vulnerable Software and Affected Versions: Android Google Search app versions prior to 13.41 Description: The issue is caused by the incorrect usage of uri.getLastPathSegment, allowing a symbolic encoded string to bypass path logic and access unintended directories. This could lead to...

[SECURITY] Fedora 37 Update: xfce4-places-plugin-1.8.3-1.fc37

A menu with quick access to folders, documents, and removable media. The Places plugin brings much of the functionality of GNOME=EF=BF=BD=EF=BF=BD=EF =BF=BDs Places menu to Xfce. It puts a simple button on the panel. Clicking on this button opens up a menu with 4 sections: 1 System-defined...

GHSA-96VH-4RFP-C42C HTSJDK is vulnerable to exposure of resource(s) to the wrong sphere

The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it...

USN-5745-1 shadow vulnerability

Florian Weimer discovered that shadow was not properly copying and removing user directory trees, which could lead to a race condition. A local attacker could possibly use this issue to setup a symlink attack and alter or remove directories without authorization...

PT-2022-7423 · Gnu Emacs +9 · Gnu Emacs +9

Name of the Vulnerable Software and Affected Versions: GNU Emacs versions through 28.2 Description: The issue is related to the incorrect neutralization of special elements in the lib-src/etags.c component of the ctags program in the EMACS text editor. This can allow an attacker to execute comman...

Siemens syngo Dynamics path traversal vulnerability

Siemens syngo Dynamics is a cardiovascular imaging and information solution from Siemens, a German company designed to be a centralized digital hub for complete cardiovascular services. Designed to be a centralized digital hub for complete cardiovascular services, Siemens syngo Dynamics is...

GHSA-XGQ8-JQ9W-77R5 Apache Archiva subject to arbitrary directory deletion by users.

Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories. Users with write permissions to a repository can delete arbitrary directories...

Design/Logic Flaw

Users with write permissions to a repository can delete arbitrary directories...

PT-2022-25341 · Apache · Apache Archiva

Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.9 Description: The issue allows users with write permissions to a repository to delete arbitrary directories. This is a problem because it can lead to data loss and potential system instability...

Apache Archiva 安全漏洞

Apache Archiva is a suite of software from the Apache Foundation for managing one or more remote repositories. The software provides remote Repository agents, role-based security access management, and usage reporting.A security vulnerability exists in versions of Apache Archiva prior to 2.2.9,...

CVE-2022-45129

Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise befo...

PT-2022-27409 · Payara · Payara Platform Community +1

Name of the Vulnerable Software and Affected Versions: Payara Platform Community versions prior to 4.1.2.191.38 Payara Platform Community versions 5.x prior to 5.2022.4 Payara Platform Community versions 6.x prior to 6.2022.1 Payara Platform Enterprise versions prior to 5.45.0 Description: The...

CVE-2022-45129

Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise befo...

Amazon Linux 2022 : rsync, rsync-daemon (ALAS2022-2022-158)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-158 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input has many distant matches. For some rare inputs with a large numbe...

Path traversal

OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root...

CVE-2022-43451

CVE-2022-43451 affects OpenHarmony v3.1.2 and earlier, with a Multiple path traversal in the appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape the application sandbox; if chained with other vulnerabilities, an unprivileged process could gain full root pri...

The vulnerability of the Moxa MXView network control software lies in its lack of functionality for checking the path name of the restricted access directory. This allows attackers to read arbitrary files.

The vulnerability of the Moxa MXView network control software is related to deficiencies in checking the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...