CVE-2020-7311

Privilege Escalation vulnerability in the installer in McAfee Agent MA for Windows prior to 5.6.6 allows local users to assume SYSTEM rights during the installation of MA via manipulation of log files...

Huawei EulerOS: Security Advisory for nfs-utils (EulerOS-SA-2020-1871)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-7310

Privilege Escalation vulnerability in the installer in McAfee McAfee Total Protection MTP trial prior to 4.0.161.1 allows local users to change files that are part of write protection rules via manipulating symbolic links to redirect a McAfee file operations to an unintended file...

CVE-2020-7310

CVE-2020-7310 describes a privilege-escalation flaw in the installer of McAfee Total Protection (MTP) trial before version 4.0.161.1. The issue arises from manipulating symbolic links to redirect McAfee file operations to an unintended file, enabling local users to modify files governed by write-...

Code injection

ABBYY network license server in ABBYY FineReader 15 before Release 4 aka 15.0.112.2130 allows escalation of privileges by local users via manipulations involving files and using symbolic links...

Code injection

IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw after WinCollect installation. IBM X-Force ID: 181861...

CVE-2020-4486

CVE-2020-4486 affects IBM QRadar Wincollect 7.2.0–7.2.9, where an authenticated user could overwrite or delete arbitrary files due to a flaw introduced after WinCollect installation. IBM’s bulletin confirms the issue and lists affected versions, with a high impact (I/H, A/H) and network attack su...

CVE-2020-15658

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR 78.1, Firefox...

CVE-2020-5609

CVE-2020-5609 is a directory traversal vulnerability affecting Yokogawa CAMS for HIS CENTUM CS 3000 (incl. CENTUM CS 3000 Small, R3.08.10–R3.09.50), CENTUM VP (incl. CENTUM VP Small/Basic, R4.01.00–R6.07.00), B/M9000CS (R5.04.01–R5.05.01), and B/M9000 VP (R6.01.01–R8.03.01). The issue allows a re...

CVE-2020-15135

save-server npm package before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation Tokens etc.. The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...

CVE-2020-6012

ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links. This allows an...

CVE-2020-6012

CVE-2020-6012 affects ZoneAlarm Anti-Ransomware prior to version 1.0.713, where the application copies report files from a directory with low privileges. An unprivileged user could timestampedly replace those files with malicious or linked content, potentially enabling local privilege escalation....

Code injection

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell tmsh may be able to conduct arbitrary file read/writes via the built-in sftp functionality...

ZTE U31R20 Design Error Vulnerability

The ZTE U31R20 is a network management product from China's ZTE Corporation ZTE. A security vulnerability exists in ZTE U31R20 version V12.17.20T115. The vulnerability can be exploited by an attacker to log in to the FTP server to tamper with the password and illegally download, modify, upload or...

cae input validation error vulnerability

cae is a compression/decompression software package. An input validation error vulnerability exists in the ExtractTo feature in all versions of cae, which stems from the program failing to properly escape the path to a file in a zip archive, and can be exploited by an attacker to add or replace...

CVE-2020-14975

The driver in IOBit Unlocker 1.1.2 allows a low-privileged user to delete, move, or copy arbitrary files via IOCTL code 0x222124...

CVE-2020-14946

CVE-2020-14946 affects Global RADAR BSA Radar versions 1.6.7234.24750 and earlier. The vulnerability resides in the Administrator section of the Surveillance module via the /UC/downloadFile.ashx endpoint, where manipulating FileName and FilePath (in the URL or through a proxy) can disclose local ...

CVE-2017-18875

Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 is vulnerable when local storage for files is used. A System Admin can create arbitrary files due to the underlying issue. Connected sources (SUSE SU-2025 and related advisories) confirm the affected versions and the same impact, but the provided d...

Race condition

CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and contro...

UBUNTU-CVE-2020-13882

CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and contro...