2783 matches found
CVE-2020-6347
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HDR file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation...
CVE-2020-6330
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation...
CVE-2020-6355
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TGA file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation...
CVE-2020-6335
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation...
CVE-2020-7311
Privilege Escalation vulnerability in the installer in McAfee Agent MA for Windows prior to 5.6.6 allows local users to assume SYSTEM rights during the installation of MA via manipulation of log files...
Huawei EulerOS: Security Advisory for nfs-utils (EulerOS-SA-2020-1871)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-7310
Privilege Escalation vulnerability in the installer in McAfee McAfee Total Protection MTP trial prior to 4.0.161.1 allows local users to change files that are part of write protection rules via manipulating symbolic links to redirect a McAfee file operations to an unintended file...
CVE-2020-7310
CVE-2020-7310 describes a privilege-escalation flaw in the installer of McAfee Total Protection (MTP) trial before version 4.0.161.1. The issue arises from manipulating symbolic links to redirect McAfee file operations to an unintended file, enabling local users to modify files governed by write-...
Code injection
ABBYY network license server in ABBYY FineReader 15 before Release 4 aka 15.0.112.2130 allows escalation of privileges by local users via manipulations involving files and using symbolic links...
Code injection
IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw after WinCollect installation. IBM X-Force ID: 181861...
CVE-2020-4486
CVE-2020-4486 affects IBM QRadar Wincollect 7.2.0–7.2.9, where an authenticated user could overwrite or delete arbitrary files due to a flaw introduced after WinCollect installation. IBM’s bulletin confirms the issue and lists affected versions, with a high impact (I/H, A/H) and network attack su...
CVE-2020-15658
The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR 78.1, Firefox...
CVE-2020-5609
CVE-2020-5609 is a directory traversal vulnerability affecting Yokogawa CAMS for HIS CENTUM CS 3000 (incl. CENTUM CS 3000 Small, R3.08.10–R3.09.50), CENTUM VP (incl. CENTUM VP Small/Basic, R4.01.00–R6.07.00), B/M9000CS (R5.04.01–R5.05.01), and B/M9000 VP (R6.01.01–R8.03.01). The issue allows a re...
CVE-2020-15135
save-server npm package before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation Tokens etc.. The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
CVE-2020-6012
ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links. This allows an...
CVE-2020-6012
CVE-2020-6012 affects ZoneAlarm Anti-Ransomware prior to version 1.0.713, where the application copies report files from a directory with low privileges. An unprivileged user could timestampedly replace those files with malicious or linked content, potentially enabling local privilege escalation....
Code injection
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell tmsh may be able to conduct arbitrary file read/writes via the built-in sftp functionality...
ZTE U31R20 Design Error Vulnerability
The ZTE U31R20 is a network management product from China's ZTE Corporation ZTE. A security vulnerability exists in ZTE U31R20 version V12.17.20T115. The vulnerability can be exploited by an attacker to log in to the FTP server to tamper with the password and illegally download, modify, upload or...
cae input validation error vulnerability
cae is a compression/decompression software package. An input validation error vulnerability exists in the ExtractTo feature in all versions of cae, which stems from the program failing to properly escape the path to a file in a zip archive, and can be exploited by an attacker to add or replace...