CVE-2018-7158

It was found that the 'path' module from Node.js was vulnerable to a Regular Expression Denial of Service REDoS flaw. An attacker able to provide a specially crafted file path to a Node.js script could force it to hang indefinitely...

Directory Traversal

github.com/containers/buildah is vulnerable to directory traversal. The image building process does not properly handle file path as well as symlinks. An attacker is able to exploit the vulnerability to overwrite arbitrary files on the file system and potentially escalation privileges by...

PT-2020-19980

Name of the Vulnerable Software and Affected Versions UniFi Video Server versions 3.9.3 and prior Description The web interface Firmware Update functionality does not validate firmware download destinations, allowing manipulation of the destination file path to be outside the intended directory...

PT-2020-12202

Name of the Vulnerable Software and Affected Versions Open Source Social Network OSSN versions through 5.3 Description An issue was discovered in Open Source Social Network OSSN where a user-controlled file path with a weak cryptographic rand can be used to read any file with the permissions of t...

Joomla! Component GMapFP 3.30 - Arbitrary File Upload

Joomla! Component GMapFP 3.30 - Arbitrary File Upload Exploit Title: Joomla! Component GMapFP 3.30 - Arbitrary File Upload Google Dork: inurl:''comgmapfp'' Date: 2020-03-25 Exploit Author: ThelastVvV Vendor Homepage:https://gmapfp.org/ Version: Version J3.30pro Tested on: Ubuntu PoC:...

CVE-2020-5844

index.php?sec=godmode/extensions&sec2=extensions/filesrepo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742FIXPERL2020...

VMware Workstation Virtual Printer External Control of File Name Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Virtual Print...

EulerOS Virtualization for ARM 64 3.0.2.0 : perl-File-Path (EulerOS-SA-2020-1187)

According to the version of the perl-File-Path package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Race condition in the rmtree and removetree functions in the File-Path module before 2.13 for Perl allows attacker...

Huawei EulerOS: Security Advisory for perl-File-Path (EulerOS-SA-2020-1187)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-1096

NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection...

Design/Logic Flaw

NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection...

CVE-2012-1096

NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection...

CVE-2012-1096

NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection...

wildfly: Race condition on PID file allows for termination of arbitrary processes by local users

A flaw was discovered in wildfly that would allow local users, who are able to execute init.d script, to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root...

Arbitrary Code Execution

pdf-image is vulnerable to arbitrary code execution. Lack of validation of user input allows an attacker to execute arbitrary code via a malicious PDF file path...

Path Traversal

ansible is vulnerable to path traversal. The vulnerability exists as it does not properly normalize the file path to ensure that the file in the archive does not escape the extraction path...

CVE-2020-8132: Improper Control of Generation of Code

Lack of input validation in pdf-image npm package version = 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input...

PT-2020-19968

Name of the Vulnerable Software and Affected Versions pdf-image versions = 2.0.0 Description The issue is related to a lack of input validation in the pdf-image npm package, which may allow an attacker to run arbitrary code if the PDF file path is constructed based on untrusted user input...

SUSE-SU-2020:14290-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox was updated to version 68.5.0 ESR bsc1163368. Security issues fixed: - CVE-2020-6796: Fixed a missing bounds check on shared memory in the parent process bsc1163368. - CVE-2020-6798: Fixed a JavaScript code injection issue caused ...

Atlassian Confluence Server Information Disclosure (CVE-2019-3394)

A local file inclusion vulnerability exists in Atlassian Confluence Server. This vulnerability is due to improper validation of file path. A remote, authenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successful exploitation could lead to...