[ASA-202102-26] firejail: privilege escalation

Arch Linux Security Advisory ASA-202102-26 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-26910 Package : firejail Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1545 Summary ======= The package firejail before...

CVE-2021-21292

Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are impacted. Attacker needs write access to the filesystem on the host machine. If Java path includes a space, then attacker can lift their...

CVE-2020-15097

loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, ...

CVE-2021-21011

Adobe Captivate 2019 version 11.5.1.499 and earlier is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with permissions to write to the file system could leverage this vulnerability to escalate privileges...

CVE-2021-21011 Uncontrolled Search Path Element in Adobe Captivate 2019

Adobe Captivate 2019 version 11.5.1.499 and earlier is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with permissions to write to the file system could leverage this vulnerability to escalate privileges...

CVE-2021-21612

Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-21614

Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-21614

Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-21612

Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-21612: Insufficiently Protected Credentials

Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2021-21614: Insufficiently Protected Credentials

Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

The vulnerability of the PFileSystemRequestConstructor function in browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows for bypassing access control to the file system in the shell environment, enabling attackers to gain access to protected information.

The vulnerability of the PFileSystemRequestConstructor function in browsers such as Firefox, Firefox ESR, and the email client Thunderbird relates to bypassing access controls for the file system in the shell. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain...

Improper Access Control

chromium is vulnerable to improper access control. The vulnerability exists due to the inappropriate allowance of the setDownloadBehavior devtools protocol feature in extensions in Google Chrome, allowing an attacker with control of an installed extension to access files on the local file system...

Microsoft SharePoint Information Disclosure Vulnerability (CNVD-2020-63714)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An information...

SAP NetWeaver AS JAVA Command Execution Vulnerability (CNVD-2020-62998)

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A security vulnerability exists in SAP NetWeaver AS JAVA version 7.20, 7.30, 7.31, 7.40, and 7.50 that allows an...

CVE-2020-26820

SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose unauthenticated access to the file system and upload a malicious file. The attacker or another user can then use a separate...

CVE-2020-26820

SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose unauthenticated access to the file system and upload a malicious file. The attacker or another user can then use a separate...

CVE-2020-26820

SAP NetWeaver AS Java remote code execution (CVE-2020-26820) affects SAP NetWeaver AS Java versions 7.20, 7.30, 7.31, 7.40, 7.50. An attacker authenticated as an administrator can use the administrator console to expose unauthenticated file-system access and upload a malicious file, enabling the ...

About the security content of the Apple TV app for Fire OS

About the security content of the Apple TV app for Fire OS This document describes the security content of the Apple TV app for Fire OS. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

Dell OpenManage Server Administrator Path Traversal (DSA-2020-172)

The version of Dell OpenManage Server Administrator OMSA running on the remote host is affected by a path traversal vulnerability due to improper sanitization of user-supplied input to a web API request. An unauthenticated, remote attacker can exploit this, via a crafted request, to gain file...