CVE-2022-25359

On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files...

CVE-2021-22448

There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause unauthorized read and write of some files...

CVE-2022-25365

CVE-2022-25365 affects Docker Desktop for Windows, stated as: before 4.5.1 allows attackers to move arbitrary files due to an incomplete fix for CVE-2022-23774. Connected evidence includes a GitHub exploit repository (exploit for CVE-2022-25365) listing PoC files (poc.py, createsymlink.exe, junct...

Format string

When a user opens a manipulated Adobe Illustrator file format .ai, ai.x3d received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with...

Mageia: Security Advisory (MGASA-2019-0268)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GO-2021-0228 Path traversal in github.com/unknwon/cae

The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2022-23107

Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system...

CVE-2022-23107

Jenkins Warnings Next Generation Plugin 9.10.2 and earlier is vulnerable: it does not restrict the filename when configuring a custom ID, allowing attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller filesystem. Remediation p...

Input validation

A origin validation error vulnerability in Trend Micro Apex One on-prem and SaaS could allow a local attacker drop and manipulate a specially crafted file to issue commands over a certain pipe and elevate to a higher level of privileges. Please note: an attacker must first obtain the ability to...

GHSA-557G-R22W-9WVX Incorrect Permission Assignment for Critical Resource in Singularity

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system e.g. ssh could exploit this vulnerability due to insecure permissions allowing a user to edit files within /run/singularity/instances/sing//. The manipulation of those files ca...

Design/Logic Flaw

When a user opens manipulated Jupiter Tessellation .jt file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application...

CVE-2021-42068

CVE-2021-42068 affects SAP 3D Visual Enterprise Viewer 9.0. Reports describe an input validation error when opening manipulated GIF files from untrusted sources, causing the application to crash and become temporarily unavailable until restart. The CVSS indicates low availability impact (A: LOW) ...

CVE-2021-42070

SAP 3D Visual Enterprise Viewer 9.0 is affected by an input-validation flaw in Jupiter Tessellation (JT) files, causing a crash and temporary unavailability when opening manipulated JT files from untrusted sources. Root cause identified as failure to validate JT inputs. SAP has issued security pa...

CVE-2021-42070

When a user opens manipulated Jupiter Tessellation .jt file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application...

CVE-2021-37088

There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can write any content to any file...

CVE-2021-35245

When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine...

CVE-2021-35245

CVE-2021-35245 affects SolarWinds Serv-U: when a user has admin rights in the Serv-U Console, they can move, create, and delete files accessible on the Serv-U host machine. The Nessus plugin for SolarWinds Serv-U 15.2.4

CVE-2021-35245: Improper Access Control

When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine...

PT-2021-20865 · Unknown · Serv-U Console

Name of the Vulnerable Software and Affected Versions: Serv-U Console affected versions not specified Description: The issue allows a user with admin rights in Serv-U Console to move, create, and delete any files accessible on the Serv-U host machine. Recommendations: At the moment, there is no...

CVE-2021-43783

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend...