CVE-2023-32525

Trend Micro Mobile Security Enterprise 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit thi...

CVE-2023-32526

Trend Micro Mobile Security Enterprise 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit thi...

Guava vulnerable to insecure use of temporary directory

Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files...

Google Guava 安全漏洞

Google Guava is a core Java library from Google that includes a graphics library, function types, I/O, and string handling. A security vulnerability exists in Google Guava versions 1.0 through 31.1 that originates from allowing users and applications on a machine with access to the default Java...

PT-2023-23647 · Vipre · Vipre Antivirus Plus

Name of the Vulnerable Software and Affected Versions: VIPRE Antivirus Plus affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged...

The vulnerability of the uploadFile function in the D-View 8 network device management platform allows a hacker to create arbitrary files.

The vulnerability of the uploadFile function in the D-View 8 network device management platform is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to create arbitrary files remotely...

D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability

This vulnerability allows remote attackers to create arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadFile function. The issue results from the lack of proper validation of a user-suppli...

Delta Industrial Automation DIALink Directory Traversal Arbitrary File Creation Vulnerability

This vulnerability allows remote attackers to create arbitrary files on affected installations of Delta Industrial Automation DIALink. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the opcu...

PT-2023-2875 · D Link · D-Link D-View

Name of the Vulnerable Software and Affected Versions: D-Link D-View affected versions not specified Description: This issue allows remote attackers to create arbitrary files on affected installations of D-Link D-View, with authentication required to exploit it. The specific flaw exists within th...

CVE-2023-32986

Jenkins File Parameter Plugin 285.v757c5b67ac25 and earlier does not restrict the name and resulting uploaded file name of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified...

CVE-2023-32986

CVE-2023-32986 concerns the Jenkins File Parameter Plugin. Versions 285.v757c5b_67a_c25 and earlier allow attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system by supplying attacker-chosen content, due to an unrestricted Stashed File P...

CVE-2023-32986

Jenkins File Parameter Plugin 285.v757c5b67ac25 and earlier does not restrict the name and resulting uploaded file name of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified...

PT-2023-24119 · Jenkins · Jenkins File Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins File Parameter Plugin versions 285.v757c5b 67a c25 and earlier Description: The issue allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified...

The vulnerability of the inode_init_owner() function in the fs/inode.c file of the XFS file system’s kernel of the Linux operating system allows a malicious actor to escalate their privileges and gain access to protected information. It can also cause service interruptions.

The vulnerability of the inodeinitowner function in the fs/inode.c file of the XFS file system in the Linux operating system is related to the incorrect setting of access group attributes during file creation. Exploiting this vulnerability can allow an attacker to enhance their privileges and gai...

PT-2023-23857 · Trend Micro · Trend Micro Mobile Security

Name of the Vulnerable Software and Affected Versions: Trend Micro Mobile Security Enterprise version 9.8 SP5 Description: The issue allows a remote attacker to create arbitrary files on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged...

PT-2023-23856 · Trend Micro · Trend Micro Mobile Security

Name of the Vulnerable Software and Affected Versions: Trend Micro Mobile Security Enterprise version 9.8 SP5 Description: The issue allows a remote attacker to create arbitrary files on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged...

GL.iNet devices 命令注入漏洞

GL.iNet devices are a series of hardware devices from China's Guanglian Zhitong GL.iNet company. A command injection vulnerability exists in GL.iNet devices prior to version 3.216, which originates from allowing an empty file to be created anywhere on the file system. An attacker could use this...

RESTEasy: creation of insecure temp files

In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user...

RESTEasy: creation of insecure temp files

In RESTEasy the insecure File.createTempFile is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user...

CVE-2023-31472

An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied...