Arbitrary File Write

rasa is vulnerable to arbitrary file write. A malicious user is able to cause arbitrary file writes within specific directories via a trained model which contains a crafted model.tar.gz file...

Delta Electronics DiaLink 代码问题漏洞

DIALink is an equipment networking platform from Delta Electronics that effectively manages CNC machines and PLC-controlled machines, collects on-site equipment data and connects it to the upper management platform through a unified interface, and at the same time provides visual information...

CivetWeb 路径遍历漏洞

CivetWeb is an open source, easy-to-use, powerful, C/C++-embeddable web server with optional CGI, SSL, and Lua support. A security vulnerability exists in CivetWeb that stems from a failure of a network system or product to properly filter special elements in a resource or file path. An attacker...

CVE-2021-42261

Revisor Video Management System VMS before 2.0.0 has a directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of restricted directory on the remote server. This could lead to the disclosure of...

BookStack has an unspecified vulnerability

BookStack is an open source set of BookStackApp Bookstackapp team's platform for building wiki documents using PHP and Laravel. bookstackapp suffers from a security vulnerability that stems from an improper restriction on the pathname of restricted directories in bookstack. An attacker could...

Trojan-Spy.Win32.Ardamax.ocx Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/78a39875a0adb110cf3c7de3a0d1384c.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.Ardamax.ocx Vulnerability: Insecure Permissions Description: The malware creates an...

Security Bulletin: Multiple Security Vulnerabilities Have been addressed in IBM Security Access Manager

Summary Multiple Security Vulnerabilities have been fixed in the IBM Security Access Manager ISAM version 9.0.7.2 Vulnerability Details CVEID: CVE-2019-10208 DESCRIPTION: PostgreSQL is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to the...

BookStack 路径遍历漏洞

BookStack is an open source set of BookStackApp Bookstackapp team's platform for building wiki documents using PHP and Laravel. bookstackapp suffers from a security vulnerability that stems from an improper restriction on the pathname of restricted directories in bookstack. An attacker could...

The vulnerability of the TSWbPrxy component in Windows operating systems, which allows attackers to increase their privileges

The vulnerability of the TSWbPrxy component in Windows operating systems is related to deficiencies in path validation for restricted access directories. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

The vulnerability in the VMI web interface of vCenter Server Appliance, a management tool for VMware vCenter Server virtual infrastructure, allows an attacker to gain unauthorized access to protected information.

The vulnerability in the VCenter Server Management Interface of the VMware vCenter Server web interface relates to deficiencies in path name checking for access to restricted directories. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by...

Siemens SINEC NMS 路径遍历漏洞

SINEC NMS is a network management system from Siemens for monitoring and managing industrial networks.A path traversal vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1, which stems from the failure of a network system or product to properly filter special elements in a resourc...

Online Traffic Offense Management System 1.0 - Privilage escalation (Unauthenticated)

Exploit Title: Online Traffic Offense Management System 1.0 - Privilage escalation Unauthenticated Date: 07/10/2021 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Vendor Homepage: https://www.sourcecodester.com Software Link:...

DEBIAN-CVE-2021-41103

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory...

USN-5100-1 containerd vulnerability

It was discovered that containerd insufficiently restricted permissions on container root and plugin directories. If a user or automated system were tricked into launching a specially crafted container image, a remote attacker could traverse directory contents and modify files and execute program...

CVE-2021-41103

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory...

CVE-2021-41103: Improper Limitation of a Pathname to a Restricted Directory

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory...

Ecoa Bas controller 路径遍历漏洞

Ecoa Bas controller is a building automation controller from Ecoa Technologies Corp. in China. A path traversal vulnerability exists in Ecoa Bas controller, which can be exploited by attackers to compromise the device directory content by using the GET parameter in the file manager...

CVE-2021-34409

It was discovered that the installation packages of the Zoom Client for Meetings for MacOS Standard and for IT Admin installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post-...

Eyoucms Directory Traversal (CVE-2021-39500)

A directory traversal vulnerability exists in Eyoucms. Successful exploitation of this vulnerability would allow a remote attacker to list directories on the affected system...

CVE-2021-22015

The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance...