UBUNTU-CVE-2019-13012

The keyfile settings backend in GNOME GLib aka glib2.0 before 2.60.0 creates directories using gfilemakedirectorywithparents kfsb-dir, NULL, NULL and files using gfilereplacecontents kfsb-file, contents, length, NULL, FALSE, GFILECREATEREPLACEDESTINATION, NULL, NULL, NULL. Consequently, it does n...

Microsoft Windows - CmpAddRemoveContainerToCLFSLog Arbitrary File/Directory Creation Exploit

Windows: CmpAddRemoveContainerToCLFSLog Arbitrary File/Directory Creation EoP Platform: Windows 10 1809 not tested earlier Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The kernel’s CmpAddRemoveContainerToCLFSLog function doesn’t...

Directory traversal

A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WSFTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized director...

CVE-2019-9723

LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry...

PT-2019-6227 · Samba +5 · Samba +5

Name of the Vulnerable Software and Affected Versions: Samba versions prior to 4.13.16 Description: The issue allows a malicious client to create a directory in an area of the server file system not exported under the share definition by using an SMB1 or NFS race. This can happen if SMB1 is enabl...

[SECURITY] [DLA 1753-3] proftpd-dfsg regression update

Package : proftpd-dfsg Version : 1.3.5e+r1.3.5-2+deb8u2 Debian Bug : 929020 The update of proftpd-dfsg issued as DLA-1753-1 caused a regression when the creation of a directory failed during sftp transfer. The sftp session would be terminated instead of failing gracefully due to a non-existing...

SUSE-SU-2019:14042-1 Security update for samba

This update for samba fixes the following issues: Security issue fixed: - CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share bsc1131060. Non-security issue fixed: - Make init scripts create log directories before...

Debian DLA-1753-3 : proftpd-dfsg regression update

The update of proftpd-dfsg issued as DLA-1753-1 caused a regression when the creation of a directory failed during sftp transfer. The sftp session would be terminated instead of failing gracefully due to a non-existing debug logging function. For Debian 8 'Jessie', this problem has been fixed in...

PT-2019-4610 · Samba +1 · Samba +1

Name of the Vulnerable Software and Affected Versions: Samba versions 4.9 through 4.9.5 Samba versions 4.10.0 through 4.10.1 Description: A vulnerability was found in Samba related to the creation of a new Samba AD DC. During this process, files are created in a private subdirectory of the instal...

CVE-2018-4051

An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can globally create directories and subdirectories on the root file system, as well as change the permissions of existing directories...

Explore the PHP Mkdir function-vulnerability warning-the black bar safety net

A, causes In the reproducibility analysis of Wordpress-5.0.0 RCE of the time, because in the written pictures of the process, according to the picture dirname create the directory, then according to the basename of the write picture. In the directory is successfully created, the premise should be...

GOG Galaxy Input Validation Vulnerability

GOG Galaxy is a game client program. The program is used to install, launch and update games. An input validation vulnerability exists in the Privileged Assistant tool in version 1.2.47 of GOG Galaxy for macOS-based platforms. An attacker can use this vulnerability to globally create directories...

Post-Exploitation Framework for Linux Written in Bash: Orc

Orc is a simple post-exploitation written in bash. I wrote this because I myself needed a more featureful post-exploitation toolkit for Linux. It’s part of a larger bundle of scripts and tools, but I’ll add those as I write and re-write them. It takes the form of an ENV script, so load orc into a...

Arbitrary File Writes And Directory Creation

System.IO.Compression.ZipFile is vulnerable to arbitrary file writes and directory creation. The vulnerability can be triggered because it does not properly validate the trailing separator for nested paths...

VMware WorkstationPlayer 12.5.5 - Local Privilege Escalation

VMware WorkstationPlayer 12.5.5 - Local Privilege Escalation !/bin/bash VMware Workstation Local Privilege Escalation exploit CVE-2017-4915 - https://www.vmware.com/security/advisories/VMSA-2017-0009.html - https://www.exploit-db.com/exploits/42045/ Affects: - VMware Workstation Player...

Arbitrary File Writes And Directory Creation

microsoft.netcore.app System.IO.Compression.ZipFile is vulnerable to arbitrary file writes and directory creation. The vulnerability can be triggered because it does not properly validate the trailing separator for nested paths...

CVE-2018-16588

CVE-2018-16588 affects the SUSE shadow package’s useradd.c code. Local attackers could exploit it by triggering creation of non-existing intermediate directories with world-writable mode 0777 during user creation, enabling privilege escalation. The impact is local, with high secrecy/ integrity/ a...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-118.24.1 - mm/mempolicy: fix use after free when calling getmempolicy zhong jiang Orabug: 28022108 CVE-2018-10675 - Fix up non-directory creation in SGID directories Linus Torvalds Orabug: 28459478 CVE-2018-13405 - ALSA: seq: Make ioctls race-free Takashi Iwai Orabug: 28459729...

Microsoft Windows 10 - Desktop Bridge Activation Arbitrary Directory Creation Privilege Escalation

Microsoft Windows 10 - Desktop Bridge Activation Arbitrary Directory Creation Privilege Escalation Windows: Desktop Bridge Activation Arbitrary Directory Creation EoP Platform: Windows 10 1703, 1709 not tested RS4 Class: Elevation of Privilege Summary: The activator for Desktop Bridge application...

Microsoft Windows 10 - Desktop Bridge Activation Arbitrary Directory Creation Privilege Escalation

Windows: Desktop Bridge Activation Arbitrary Directory Creation EoP Platform: Windows 10 1703, 1709 not tested RS4 Class: Elevation of Privilege Summary: The activator for Desktop Bridge applications calls CreateAppContainerToken while running as a privileged account leading to creation of...