CVE-2022-33995

A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary location...

CVE-2022-33995

A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary location...

nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

A flaw was found in the npm package "tar" aka node-tar. Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an...

PT-2022-21957

Name of the Vulnerable Software and Affected Versions Devolutions Remote Desktop Manager versions prior to 2022.2 Description A path traversal issue in entry attachments allows attackers to create or overwrite files in an arbitrary location. Recommendations For versions prior to 2022.2, update to...

CVE-2022-33995: Improper Limitation of a Pathname to a Restricted Directory

A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary location...

Dell SupportAssist Client Consumer and Dell SupportAssist Client Commercial arbitrary file deletion/overwrite vulnerability

Dell SupportAssist Client is a client application from Dell USA. The program provides automated, proactive and predictive techniques for troubleshooting, etc. Dell SupportAssist Client Consumer and Dell SupportAssist Client Commercial are vulnerable to an arbitrary file deletion/overwrite...

CVE-2022-29094

Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files...

CVE-2022-29094

Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files...

CVE-2022-29094

Dell SupportAssist Client (Consumer 3.10.4 and earlier; Commercial 3.1.1 and earlier) contains an arbitrary file deletion/overwrite vulnerability. An authenticated non‑admin user can delete or overwrite arbitrary files on the system. The issue is documented as CVE-2022-29094; CVSS data in the pro...

CVE-2022-29094: Improper Limitation of a Pathname to a Restricted Directory

Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files...

Dell SupportAssist Client Path Traversal Vulnerability

Dell SupportAssist Client is a client application from Dell USA. The program provides automated, proactive and predictive techniques for troubleshooting, etc. Dell SupportAssist Client Consumer and Dell SupportAssist Client Commercial are vulnerable to an arbitrary file deletion/overwrite...

PT-2022-19411

Name of the Vulnerable Software and Affected Versions Dell SupportAssist Client Consumer versions 3.10.4 and earlier Dell SupportAssist Client Commercial versions 3.1.1 and earlier Description The issue allows an authenticated non-admin user to delete or overwrite arbitrary files on the system...

nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

A flaw was found in the npm package "tar" aka node-tar. Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an...

nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

A flaw was found in the npm package "tar" aka node-tar. Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on...

Design/Logic Flaw

An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contai...

nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

A flaw was found in the npm package "tar" aka node-tar. Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on...

nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

A flaw was found in the npm package "tar" aka node-tar. Extracting tar files that contain two directories and a symlink with names containing Unicode values that normalize to the same value on Windows systems made it possible to bypass node-tar symlink checks on directories. This allows an...

Exploit for Improper Initialization in Linux Linux_Kernel

CVE-2022-0847 CVE-2022-0847 used to achieve container escape...

GO-2022-0586 Resource exhaustion in github.com/hashicorp/go-getter and related modules

Malicious HTTP responses can cause a number of misbehaviors, including overwriting local files, resource exhaustion, and panics. Protocol switching, endless redirect, and configuration bypass are possible through abuse of custom HTTP response header processing. Arbitrary host access is possible...

GHSA-HHPM-74PM-HF35 ingress-nginx component for Kubernetes allows file overwrite

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace ...