kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members

A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group an...

Cuberite Path Traversal Vulnerability

Cuberite is a lightweight, scalable multiplayer game server written in C++. A path traversal vulnerability exists in versions of Cuberite prior to 2019-06-11, which can be exploited by an attacker to access locations outside of a restricted directory...

Power-Response Path Traversal Vulnerability

Power-Response is a modular PowerShell framework for event response . A path traversal vulnerability exists in versions of Power-Response prior to 2019-02-02, which can be exploited by an attacker to access locations outside of a restricted directory...

CVE-2019-15506

Kaseya Virtual System Administrator (VSA) up to 9.4.0.37 contains an information disclosure vulnerability. An unauthenticated attacker can issue properly formatted web requests and download sensitive files and information. The /DATAREPORTS directory (and other directories) can be exploited to har...

Security update for neovim (important)

openSUSE Security Update: Security update for neovim Announcement ID: openSUSE-SU-2019:1997-1 Rating: important References: 1137443 Cross-References: CVE-2019-12735 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This update f...

Google Android Framework Path Traversal Vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA, of which Framework is a component of the Android framework. A path traversal vulnerability in GoogleContactsSyncAdapter in Android version 10, which stems from a failure of a networked system or...

CVE-2019-11013

Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of the restricted directory on the remote server...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

WordPress 10Web Photo Gallery Plugin Path Traversal Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.10Web Photo Gallery plugin is an image management plugin used in it. A path traversal vulnerability exists in the WordPress...

The vulnerability of the IcedTea-Web plugin, related to an incorrect limitation on the path name to the restricted access catalog, allows a hacker to write arbitrary files to the device’s file system.

The vulnerability of the IcedTea-Web plugin is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system using a specially crafted file in formats: .tar, .jar, .war,...

NewStart CGSL CORE 5.04 / MAIN 5.04 : xdg-user-dirs Vulnerability (NS-SA-2019-0026)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xdg-user-dirs packages installed that are affected by a vulnerability: - It was found that the system umask policy is not being honored when creating XDG user directories /Desktop etc on first login. This could lead to user...

NewStart CGSL MAIN 4.05 : glibc Multiple Vulnerabilities (NS-SA-2019-0142)

The remote NewStart CGSL host, running version MAIN 4.05, has glibc packages installed that are affected by multiple vulnerabilities: - The GNU C Library aka glibc or libc6 before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to...

MicroDigital N-series cameras path traversal vulnerability

MicroDigital N-series cameras is an N-series network camera from MicroDigital Korea. A path traversal vulnerability exists in MicroDigital N-series cameras. An attacker could use this vulnerability to access locations outside of a restricted directory...

cPanel path traversal vulnerability (CNVD-2019-30467)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A path traversal vulnerability exists in versions of cPanel prior to 68.0.15. The vulnerability stems from a failure of a network...

cPanel path traversal vulnerability (CNVD-2019-30469)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A path traversal vulnerability exists in versions prior to cPanel 67.9999.103. The vulnerability stems from a failure of a networ...

cPanel Access Control Error Vulnerability (CNVD-2019-29607)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions of cPanel prior to 68.0.15. An attacker can exploit the vulnerability to...

kubectl path traversal vulnerability (CNVD-2019-26372)

kubectl is a command line program for running commands against a Kubernetes cluster. A path traversal vulnerability exists in kubectl. The vulnerability stems from a failure of a networked system or product to properly filter for special elements in a resource or file path. An attacker could use...

USN-4049-4 glib2.0 regression

USN-4049-1 fixed a vulnerability in GLib. The update introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that GLib created directories and files without properly restricting permissions. An attacker could possibl...

cPanel path traversal vulnerability (CNVD-2019-26341)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A path traversal vulnerability exists in versions of cPanel prior to 64.0.21. The vulnerability stems from a failure of a network...

Magento Path Traversal Vulnerability

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A path traversal vulnerability exists in Magento versions 2.1.18 before 2.1, 2.2.9 before 2.2.2, and 2.3.2 before...