Renaming an item to a protected hidden folder deletes the target (NC-SA-2020-017)

Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name...

Serve-here.js path traversal vulnerability

serve-here.js is an HTTP static file server. A path traversal vulnerability in serve-here.js v1.1.3 and prior versions, which arises from a failure of a networked system or product to properly filter for special elements in the path of a resource or file, can be exploited by an attacker to access...

USN-4049-2 glib2.0 vulnerability

USN-4049-1 fixed a vulnerability in GLib. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that GLib created directories and files without properly restricting permissions. An attacker could possibly use this iss...

USN-4049-1 glib2.0 vulnerability

It was discovered that GLib created directories and files without properly restricting permissions. An attacker could possibly use this issue to access sensitive information...

The vulnerability of the information protection tool against unauthorized access—Akord-Win64—allows a intruder to gain access to confidential information.

The vulnerability of the Akord-Win64 information protection tool against unauthorized access is related to deficiencies in security mechanisms when working with hidden files and directories. Exploiting this vulnerability could allow a malicious actor, operating locally, to gain access to...

Rock-ON - An All In One Recon Tool That Will Just Get A Single Entry Of The Domain Name And Do All Of The Work Alone

Rock-On is a all in one recon tool that will help your Recon process give a boost. It is mainley aimed to automate the whole process of recon and save the time that is being wasted in doing all this stuffs manually. A thorough blog will be up in sometime. Stay tuned for the Stable version with a...

PGP Ecosystem Targeted in ‘Poisoning’ Attacks

A long-feared attack vector used against Pretty Good Privacy, the framework used to authenticate and keep email messages private, is being exploited for the first time. The attack, which takes aim at keyserver verification directories, makes it impossible for Pretty Good Privacy PGP to work...

The vulnerability of the RouterOS operating system in MikroTik routers, related to errors in path name restrictions for restricted access directories, allows attackers to bypass authentication procedures.

The vulnerability of the RouterOS operating system for MikroTik routers is related to errors in path name restrictions for restricted access directories. Exploiting this vulnerability allows a malicious actor to read and write arbitrary files outside of the /rw/disk directory, through interfaces...

Synology Moments Path Traversal Vulnerability

Synology Moments is an image and video categorization management application from Synology, a Taiwan-based company. The program is able to recognize people, subjects and locations in photos and automatically categorize them through image recognition technology. A path traversal vulnerability exis...

The vulnerability of the Open Cloud Integrity Technology, which is used to create cloud services, and the OpenAttestation agent exists due to errors in path name restrictions for restricted access directories. This allows attackers to disclose protected information.

The vulnerability of the Open Cloud Integrity Technology, which is used to create cloud services, and the OpenAttestation agent exists due to errors in path name restrictions for restricted access directories. Exploiting this vulnerability could allow a attacker to disclose protected information...

CVE-2019-6329

HP Support Assistant 8.7.50 and earlier allows a user to gain system privilege and allows unauthorized modification of directories or files. Note: A different vulnerability than CVE-2019-6328...

CVE-2019-6329

HP Support Assistant 8.7.50 and earlier allows a user to gain system privilege and allows unauthorized modification of directories or files. Note: A different vulnerability than CVE-2019-6328...

Google Kubernetes Path Traversal Vulnerability

Google Kubernetes is a set of open source Docker container cluster management system from the U.S. company Google Google. The system provides resource scheduling, deployment and operation, service discovery and scaling up and down for containerized applications. A path traversal vulnerability...

Sony Bravia TV Photo Sharing Plus Path Traversal Vulnerability

Sony Bravia TV is a smart TV from Sony Japan.Photo Sharing Plus is one of the photo sharing components. A path traversal vulnerability exists in the Photo Sharing Plus component in Sony Bravia TV version 8.587 and earlier. The vulnerability stems from a failure of a networked system or product to...

Pydio Cells Elevation of Privilege Vulnerability

Pydio Cells is a transition application for managing files on a Pydio Cells 1.2.X server. An elevation of privilege vulnerability exists in versions of Pydio Cells prior to 1.5.0, which stems from Pydio Cells failing to neutralize the... /element, which can be exploited by an attacker with very l...

Zucchetti HR Portal Path Traversal Vulnerability

Zucchetti HR Portal is a human resources management system. A path traversal vulnerability exists in Zucchetti HR Portal 2019-03-15 and prior versions. The vulnerability stems from a failure of a networked system or product to properly filter for specific elements in a resource or file path. An...

USN-4024-1 evince update

As a security improvement, this update adjusts the AppArmor profile for the Evince thumbnailer to reduce access to the system and adjusts the AppArmor profile for Evince and Evince previewer to limit access to the DBus system bus. Additionally adjust the evince abstraction to disallow writes on...

BlogEngine path traversal vulnerability (CNVD-2019-18836)

BlogEngine is an open source ASP.NET blog system . The system supports Ajax comments , custom themes and so on. A path traversal vulnerability exists in BlogEngine 3.3.7 and earlier versions. The vulnerability stems from the failure of a network system or product to properly filter special elemen...

UBUNTU-CVE-2019-12779

libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames under /dev/shm and /tmp without OEXCL...

CVE-2019-12777

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They replace secure and protected directory permissions set as default by the underlying operating system with highly insecure read, write, and execute directory...