Path traversal

Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to overwrite arbitrary file with phone uid...

CVE-2022-36850

CVE-2022-36850 is a path traversal vulnerability in Samsung CallBGProvider present before SMR Sep-2022 Release 1. The issue could allow an attacker to overwrite arbitrary files using the device UID, with local attack requirements (low privileges, no user interaction). The CVE is addressed by appl...

CVE-2022-36850: Improper Input Validation

Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to overwrite arbitrary file with phone uid...

PT-2022-23654 · Unknown · Callbgprovider

Name of the Vulnerable Software and Affected Versions: CallBGProvider versions prior to SMR Sep-2022 Release 1 Description: A path traversal issue allows an attacker to overwrite arbitrary files with the phone's user ID. Recommendations: For versions prior to SMR Sep-2022 Release 1, update to the...

Input validation

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation...

Ubuntu: Security Advisory (USN-3685-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated rsync packages fix security vulnerability

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

Oracle Linux 7 : rsync (ELSA-2022-6170)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-6170 advisory. 3.1.2-11 - Resolves: 2111170 - remote arbitrary files write inside the directories of connecting peers Tenable has extracted the preceding description block...

SUSE SLES12 Security Update : rsync (SUSE-SU-2022:2859-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2859-1 advisory. - CVE-2022-29154: Fixed an arbitrary file write issue that could be triggered by a malicious remote server bsc1201840. Tenable has extracted...

PT-2022-15396 · Ibm · Ibm Workload Scheduler

Name of the Vulnerable Software and Affected Versions: IBM Workload Scheduler versions 9.4 through 9.5 Description: The issue allows a local user to overwrite key system files, which could cause the system to crash. Recommendations: For IBM Workload Scheduler versions 9.4 through 9.5, update to a...

CVE-2022-36264

In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename a...

Privilege escalation

In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename a...

Airspan AirSpot 5410 code-related vulnerabilities

The Airspan AirSpot 5410 is an advanced LTE, CAT12, outdoor, multi-service product from Airspan USA. A security vulnerability exists in the Airspan AirSpot 5410 version 0.3.4.1-4 and prior versions, which originates from an unauthenticated attacker who can overwrite any file on the system or uplo...

Vulnerability fixed in rsync

A vulnerability has been fixed in rsync. The vulnerability allows a malicious person to overwrite arbitrary files on the victim's system. To exploit this vulnerability exploitation, the victim must connect to a rogue rsync server. The developers of rsync have created a new version to fix the...

Streamlit path traversal vulnerability

Streamlit is a data-oriented Python application development framework from the Streamlit open source. A path traversal vulnerability exists in Streamlit versions prior to 1.11.1, which stems from being a data-oriented python application development framework, and users hosting Streamlit...

CVE-2022-35631: Insecure Temporary File

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2...

PT-2022-4063 · Unknown · Velociraptor

Name of the Vulnerable Software and Affected Versions: Velociraptor versions prior to 0.6.5-2 Description: The issue is related to incorrect link resolution before accessing a file, which may allow an attacker to overwrite arbitrary files. On MacOS and Linux, it may be possible to perform a symli...

CVE-2022-20913: Relative Path Traversal

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is due to insufficient input validation in the web-based management interface of Cisco Nexus Dashboard. An attacker with Administrator...

Rockwell Automation ISaGRAF Workbench path traversal vulnerability

Rockwell Automation ISaGRAF Workbench is a complete programming environment for developing highly portable applications from Rockwell Automation. A path traversal vulnerability exists in Rockwell Automation ISaGRAF Workbench versions 6.0 through 6.6.9, which stems from a crafted malicious file th...

PT-2022-4718

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard affected versions not specified Description The issue is related to insufficient input validation in the management interface of Cisco Nexus Dashboard, which could allow a remote attacker to overwrite arbitrary files on a...