CVE-2020-10859

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

Directory traversal

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

The CVE-2020-10859 entry applies to Zoho ManageEngine Desktop Central (before 10.0.484). The vulnerability is a Directory Traversal in the AppDependency API that, when an authenticated user issues a crafted ZIP extraction request, allows arbitrary file writes on the target system. This is trigger...

The vulnerability of the EPUB validator FlightCrew, related to insufficient validation of input data, allows a perpetrator to write arbitrary files.

The vulnerability of the EPUB validator FlightCrew is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to write arbitrary files into any directory within a Zip archive...

decompress package path traversal vulnerability

decompress package is a decompression package. A path traversal vulnerability exists in decompress package versions prior to 4.2.1 Node.js. This vulnerability can be exploited to write arbitrary files with the help of the '... /' string to write arbitrary files...

CVE-2020-10665

Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker...

CVE-2020-10665

Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker...

Privilege escalation

Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker...

CVE-2020-10665

Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This affects Docker Desktop Enterprise before 2.1.0.9, Docker...

CVE-2019-5159

An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1.6.0.7. A specially crafted firmware update file can allow an attacker to write arbitrary files to arbitrary locations on WAGO controllers as a part of...

PT-2020-15350 · Jenkins · Jenkins Cobertura Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cobertura Plugin versions 1.15 and earlier Description: The issue allows attackers who can control the coverage report file contents to overwrite any file on the Jenkins master file system. This is due to an arbitrary file write...

The vulnerability of the Huawei PC Manager application, related to access control deficiencies, allows a perpetrator to execute arbitrary codes and write arbitrary files.

The vulnerability of the Huawei PC Manager application relates to deficiencies in access control. Exploiting this vulnerability could allow a hacker to execute arbitrary code and write arbitrary files...

Adobe Acrobat and Reader Elevation of Privilege Vulnerability (CNVD-2020-10134)

Adobe Acrobat is a PDF editing software developed by Adobe.Adobe Reader also known as Acrobat Reader is a PDF file reader developed by Adobe. Adobe Acrobat and Reader have an elevation of privilege vulnerability. An attacker can exploit the vulnerability to write to an arbitrary file system...

Unsafe Identifiers

opencast-common is using unsafe identifier. The package allows the use of arbitrary identifiers for media packages and file systems, causing the identifier mismatch as an identifier may unintentionally be changed. When the identifiers are used for file system operations, an attacker can make use ...

The vulnerabilities of the xAPI microprogramming software components of Cisco TelePresence Collaboration Endpoint (CE), Cisco TelePresence Codec (TC), and the operating system Cisco RoomOS allow attackers to gain unauthorized access to protected information and write arbitrary files to the device’s file system.

The vulnerability of the xAPI microprogramming software components of Cisco TelePresence Collaboration Endpoint, Cisco TelePresence Codec, and the operating system Cisco RoomOS exists due to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability can...

Bitbucket Server and Bitbucket Data Center Remote Code Execution Vulnerability (CNVD-2020-03926)

Atlassian Bitbucket Server and Atlassian Bitbucket Data Center are both products of Atlassian Australia.Atlassian Bitbucket Server is a Git code hosting solution. The solution manages and reviews code with features such as diff view, JIRA integration and build integration.Atlassian Bitbucket Data...

CVE-2019-19459

An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files, as demonstrated by CVE-2019-19458 files under the web root, or .bat files that will be used with auto start. This allows an attacker to execute arbitrary commands on the server...

CVE-2019-10185

It was found that icedtea-web was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox. Mitigation No kno...

Directory Traversal

Overview iobroker.js-controller is a controller that is owning the central configuration of the ioBroker installation and controls and monitors all adapter processes for the current host. Affected versions of this package are vulnerable to Directory Traversal. An attacker can include file content...

The vulnerability of the ColdFusion software platform, related to errors in restricting the path name of the restricted directory, allows a perpetrator to write any files into the device’s file system.

The vulnerability of the ColdFusion software platform is related to errors in restricting the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system remotely...