HTTP File Server 路径遍历漏洞

HTTP File Server is a simple tool that allows you to access your phone's files from your desktop, tablet or other device without any special software - just a web browser. A security vulnerability exists in HTTP File Server for Android version 1.4.1, which stems from a path traversal issue. An...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via a crafted Zip file, which allows arbitrary code execution by passing a malicious file. Details A Directory Traversal attack also known as path traversal aims to access files and directories that are stored outsid...

CVE-2022-20806

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker to write files or disclose sensitive information on an affected device. For more information about...

The vulnerability of the Node-tar module in the Node.js library allows a hacker to write any files or execute any code.

The vulnerability of the Node-tar module in the Node.js library is related to insufficient checking of the path name to the restricted access directory. Exploiting this vulnerability could allow an attacker to write arbitrary files or execute arbitrary code...

CVE-2022-24108

The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted...

The vulnerability of the update process for Cisco Unified Communications Manager (CM) and Cisco Unified Communications Manager Session Management Edition (SME) allows a perpetrator to write arbitrary files.

The vulnerability of the Cisco Unified Communications Manager CM and Cisco Unified Communications Manager Session Management Edition SME system updates lies in improper external management of file names or paths. Exploiting this vulnerability allows a malicious actor to write arbitrary files usin...

ftcms arbitrary file writing vulnerability

ftcms is a content management system from ftcms. ftcms version 2.1 and previous versions have an arbitrary file write vulnerability, which originates from the lack of valid file checksum in admin/controllers/tp.php and can be exploited by attackers to cause arbitrary file writes...

OESA-2022-1650 xz security update

XZ Utils is free general-purpose data compression software with a high compression ratio. XZ Utils were written for POSIX-like systems, but also work on some not-so-POSIX systems. XZ Utils are the successor to LZMA Utils. The core of the XZ Utils compression code is based on LZMA SDK, but it has...

OESA-2022-1629 gzip security update

gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz. Security Fixes: The vulnerability exists due to insufficient validation when handling filenames with two or more newlines. A remote attacker can force zgrep or xzgrep ...

CVE-2022-1537

A flaw was found in the GruntJS package during file.copy operations. This vulnerability is capable of arbitrary file writes, that can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories. This flaw allows a...

Grunt 安全漏洞

Grunt is a JavaScript task runner. A security vulnerability exists in Grunt versions prior to 1.5.3, which stems from file.copy being susceptible to TOCTOU Attackers can exploit this vulnerability to perform arbitrary file writes...

PT-2022-13939 · Gruntjs +3 · Gruntjs +3

Name of the Vulnerable Software and Affected Versions: GruntJS versions prior to 1.5.3 Description: The issue concerns a TOCTOU Time-of-Check-to-Time-of-Use race condition in file.copy operations. This can lead to arbitrary file writes, potentially resulting in local privilege escalation if a...

CVE-2022-30333

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract aka unpack operation, as demonstrated by creating a /.ssh/authorizedkeys file. NOTE: WinRAR and Android RAR are unaffected...

Samsung Flow 安全漏洞

Samsung flow is an application for Samsung Samsung mobile devices, a software used to connect Samsung to Win10-based computers for a seamless, secure, and connected experience.An access control error vulnerability exists in versions prior to Samsung Flow 4.8.06.5, which stems from a lack of prope...

PT-2022-19224 · Samsung · Samsung Flow

Name of the Vulnerable Software and Affected Versions: Samsung Flow versions prior to 4.8.06.5 Description: The issue is related to improper access control, allowing an attacker to write files without the necessary Samsung Flow permission. Recommendations: For versions prior to 4.8.06.5, update t...

CVE-2022-25347

Delta Electronics DIAEnergie All versions prior to 1.8.02.004 is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system...

SUSE SLES15 Security Update : buildah (SUSE-SU-2022:0770-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0770-1 advisory. - The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and...

UBUNTU-CVE-2022-26520

DISPUTED In pgjdbc before 42.3.3, an attacker who controls the jdbc URL or properties can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under...

MGASA-2022-0095 Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.15.26 and fixes at least the following security issues: A vulnerability in the Linux kernel since version 5.8 due to uninitialized variables. It enables anybody to write arbitrary data to arbitrary files, even if the file is ORDONLY, immutable or on...

PT-2022-2441 · Apache · Apache Hadoop

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions prior to 3.2.3 Description: The issue is related to the unTar function in Apache Hadoop, which uses the unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. This can lead to a TAR entr...