kubectl path traversal vulnerability

kubectl is a command line program for running commands against a Kubernetes cluster. A path traversal vulnerability exists in kubectl that stems from a failure of a networked system or product to properly filter special elements in the path of a resource or file, which can be exploited by an...

Synology Calendar Path Traversal Vulnerability

Synology Calendar is a file protection program from Synology Inc. of Taiwan, China that runs on Synology NAS Network Storage Server devices. A path traversal vulnerability in Attachment Uploader in versions prior to Synology Calendar 2.2.2-0532, which stems from a failure of a networked system or...

CVE-2018-4051

An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can globally create directories and subdirectories on the root file system, as well as change the permissions of existing directories...

OverIT Geocall Log Management Directory Traversal Vulnerability

OverIT Geocall is a field service management solution from OverIT Italy. A path traversal vulnerability exists in version 6.3 prior to OverIT Geocall build 2:346977, which arises from a failure of a networked system or product to properly filter for specific elements in the path of a resource or...

SUSE SLED12 / SLES12 Security Update : Recommended update for adcli, sssd (SUSE-SU-2019:0805-1)

This update for adcli and sssd provides the following improvement : Security vulnerability fixed : CVE-2019-3811: Fix fallbackhomedir returning '/' for empty home directories bsc1121759 Other fixes: Add an option to disable checking for trusted domains in the subdomains provider bsc1125617 Clear...

Hackers using hacked WordPress & Joomla sites to drop malware

By Waqas Apparently, the malware attack is carried out by Russian speaking hackers. The IT security researchers at Zscaler have discovered a sophisticated malware campaign targeting websites based on WordPress and Joomla content management system CMS. The campaign works in such a way that hackers...

openSUSE Security Update : shadow (openSUSE-2019-721)

This update for shadow fixes the following security issue : - CVE-2018-16588: Prevent useradd from creating intermediate directories with mode 0777 bsc1106914 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

LogicalDOC 8.2 Path Traversal Vulnerability

Impact In order to exploit this vulnerability an attacker needs to be an authenticated read-only user of the role guest. The attacker can read arbitrary files and create arbitrary directories on the server with the permissions of the user running the web server. It is recommended to update...

Directory Traversal

Caucho Quercus is vulnerable to directory traversal. A remote attacker is able to write files in arbitrary directories via the ../ characters within the pathname in an HTTP request...

CVE-2019-5415

A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to...

CVE-2018-20647

PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory...

Linux: Ungrouped files or directories

If a user or group is deleted from the system but files or directories are not, new users with these UID or GID own these files, leading to potentially having more access than intended. This script checks if any ungrouped file or directory exists on the host. Copyright C 2019 Greenbone Networks...

CVE-2019-5415

A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the victim has not allowed access to...

CVE-2019-5415

CVE-2019-5415 concerns the Node.js module serve (version 6.5.3) where the ignore feature can be bypassed via a dot-slash path, allowing an attacker to read files or list directories that should be ignored. The root cause is improper handling of ignored paths in the file-serving logic, enabling pa...

Directory Traversal Vulnerability in JTBC (PHP) Content Management System

JTBC is an open source and free cross-platform web content management system solution. A directory traversal vulnerability exists in the JTBC PHP content management system. An attacker can exploit this vulnerability to traverse any directory on the server...

Windows 7 may insecurely load Dynamic Link Libraries

Overview In standard DLL files provided by Windows 7, there are some DLL files read from the same directory where the program resides when executing the program CWE-427. Microsoft states that the root cause of this vulnerability is "Application Directory App Dir DLL planting", thus there is no pl...

CVE-2019-9201

Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories...

The vulnerability of the Zyxel VMG1312-B10D router’s microprogramming software arises from deficiencies in the checking of path names for access-limited directories. This vulnerability allows attackers to gain access to protected information.

The vulnerability of Zyxel VMG1312-B10D router microprogramming software is related to deficiencies in the checking of path names to restricted access directories. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to protected information by using a specially...

ZOHO ManageEngine Netflow Analyzer Path Traversal Vulnerability

ZOHO ManageEngine Netflow Analyzer is a set of Web-based bandwidth monitoring tools from ZOHO. The product is mainly used for bandwidth monitoring and traffic analysis. A path traversal vulnerability exists in /netflow/servlet/CReportPDFServlet in ZOHO ManageEngine Netflow Analyzer Professional...

eDirectory - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Admin auth bypass, SQLi and File Disclosure Google Dork: no defacers please ! Date: March 2019 reported to vendor without response :D Exploit Author: Efren Diaz Author contact: https://twitter.com/elefr3n Vendor Homepage:...