ALPINE-CVE-2022-24765

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder C:.git, which would be picked up by Git operation...

CVE-2022-27657

A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP Focused Run Simple Diagnostics Agent 1.0 - version 1.0...

CVE-2022-27657

A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP Focused Run Simple Diagnostics Agent 1.0 - version 1.0...

Input validation

A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP Focused Run Simple Diagnostics Agent 1.0 - version 1.0...

CVE-2022-27657

A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP Focused Run Simple Diagnostics Agent 1.0 - version 1.0...

CVE-2022-23448

A vulnerability has been identified in SIMATIC Energy Manager Basic All versions V7.3 Update 1, SIMATIC Energy Manager PRO All versions V7.3 Update 1. Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local...

PT-2022-18553 · Sap · Sap Focused Run

Name of the Vulnerable Software and Affected Versions: SAP Focused Run Simple Diagnostics Agent 1.0 version 1.0 Description: A highly privileged remote attacker can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information...

SAP Focused Run 路径遍历漏洞

SAP Focused Run is a data center and key account system operations management solution the ultimate solution for high-volume monitoring, alerting, diagnostics, and analysis from SAP Germany.SAP Focused Run is vulnerable to a directory traversal vulnerability that could be exploited by a remote...

PT-2022-13258 · Zyxel · Zyxel Ap Configurator

Name of the Vulnerable Software and Affected Versions: Zyxel AP Configurator version 1.1.4 Description: A local privilege escalation issue is caused by incorrect permission assignment in some directories of the Zyxel AP Configurator, which could allow an attacker to execute arbitrary code as a...

Directory traversal

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request...

ALPINE-CVE-2022-1122

A flaw was found in the opj2decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free on an uninitialized pointer, leading to a segmentation fault and...

workflow-multibranch: OS command execution through crafted SCM contents

A flaw was found in Jenkins. The Pipeline: Multibranch uses the same checkout directories for distinct SCMs for the readTrusted step. This flaw allows attackers with item/configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.This allows attackers to...

workflow-cps-global-lib: OS command execution through crafted SCM contents

A flaw was found in Jenkins. The JenkinsPipeline: Shared Groovy Libraries uses the same checkout directories for distinct SCMs for Pipeline libraries. This flaw allows attackers with item/configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents. This...

workflow-cps-global-lib: OS command execution through crafted SCM contents

A flaw was found in Jenkins. The JenkinsPipeline: Shared Groovy Libraries uses the same checkout directories for distinct SCMs for Pipeline libraries. This flaw allows attackers with item/configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents. This...

Input validation

CycloneDX BOM Repository Server is a bill of materials BOM repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability ...

CVE-2022-24774

CycloneDX BOM Repository Server is a bill of materials BOM repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability ...

guava: local information disclosure via temporary directory created with unsafe permissions

A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure...

CycloneDX BOM Repository Server 路径遍历漏洞

CycloneDX BOM Repository Server is a BOM repository server. It is used to distribute CycloneDX BOMs. A path traversal vulnerability exists in CycloneDX BOM Repository Server versions prior to 2.0.1, which stems from incorrect input validation leading to path traversal issues. An attacker can use...

QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405

A flaw was found in the QEMU virtio-fs shared file system daemon virtiofsd implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certa...

QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405

A flaw was found in the QEMU virtio-fs shared file system daemon virtiofsd implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certa...