GHSA-R628-MHMH-QJHW Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in...

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Overview The tar package has a high severity vulnerability before versions 3.2.2, 4.4.14, 5.0.6, and 6.1.1. Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths...

node-tar 后置链接漏洞

node-tar is a software package for file compression/decompression. A backlink vulnerability exists in node-tar, which is an arbitrary file creation/overwrite vulnerability that stems from insufficient symbolic link protection...

node-tar 路径遍历漏洞

node-tar is a software package for file compression/decompression. A path traversal vulnerability exists in node-tar, which is an arbitrary file creation/overwrite vulnerability that stems from insufficient absolute path cleanup...

Beego has a file creation race condition

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions...

GHSA-F6PX-W8RH-7R89 Beego has a file creation race condition

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions...

PT-2021-5776 · Npm +9 · Node-Tar +9

Name of the Vulnerable Software and Affected Versions: node-tar versions prior to 3.2.3 node-tar versions prior to 4.4.15 node-tar versions prior to 5.0.7 node-tar versions prior to 6.1.2 Description: The issue is related to insufficient symlink protection in the node-tar module for handling tar...

PT-2021-5756 · Npm +7 · Node-Tar +7

Name of the Vulnerable Software and Affected Versions: node-tar versions prior to 3.3.2, 4.4.14, 5.0.6, and 6.1.1 Description: The issue is related to the node-tar module for handling tar archives in Node.js, which has a problem with incorrect filtering of the '/' character sequence. This could...

CVE-2021-3042

A local privilege escalation PE vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. Exploiting this vulnerability requires the user to have file creation privilege in the...

CVE-2021-23407

The CVE-2021-23407 issue affects elFinder.Net.Core (versions 0 up to

CVE-2021-3042

A local privilege escalation PE vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. Exploiting this vulnerability requires the user to have file creation privilege in the...

ZOOK 输入验证错误漏洞

ZOOK is a Korean remote control service program that can control a remote PC from an Android phone. A security vulnerability exists in the ZOOK software remote administration tool, which can be exploited by an attacker to create and execute arbitrary files in the ZOOK agent program using the "Tig...

CVE-2021-28597

Adobe Photoshop Elements version 5.2 and earlier is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require...

CVE-2021-28597

Adobe Photoshop Elements version 5.2 and earlier is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require...

CVE-2021-28623

Adobe Premiere Elements version 5.2 and earlier is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require...

CVE-2021-28623

Adobe Premiere Elements version 5.2 and earlier is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require...

Design/Logic Flaw

Adobe Photoshop Elements version 5.2 and earlier is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require...

CVE-2021-28623

Adobe Premiere Elements 5.2 and earlier are affected by an insecure temporary file creation vulnerability that allows privilege escalation. The root cause is the creation of temporary files in directories with incorrect permissions, enabling an unauthenticated attacker to call installer functions...

CVE-2021-28623 Adobe Premiere Elements Privilege Escalation Vulnerability

Adobe Premiere Elements version 5.2 and earlier is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require...

CVE-2021-28623 Adobe Premiere Elements Privilege Escalation Vulnerability

Adobe Premiere Elements version 5.2 and earlier is affected by an insecure temporary file creation vulnerability. An unauthenticated attacker could leverage this vulnerability to call functions against the installer to perform high privileged actions. Exploitation of this issue does not require...