Android App "ELECOM File Manager" vulnerable to directory traversal

Overview Android App "ELECOM File Manager" provided by ELECOM CO.,LTD. contains a directory traversal vulnerability CWE-22 due to a flaw in the processing of the filenames when extracting the compressed files. Ryohei Koike reported this vulnerability to IPA. JPCERT/CC coordinated with the develop...

CVE-2021-3195

bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory e.g., outside the /.bitcoin directory via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented...

CVE-2021-3195

bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory e.g., outside the /.bitcoin directory via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented...

CVE-2021-3195: Improper Input Validation

bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory e.g., outside the /.bitcoin directory via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented...

CVE-2020-4887

IBM AIX 7.1, 7.2 and AIX VIOS 3.1 could allow a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. IBM X-Force ID: 190911...

CVE-2020-4887: Undefined Security Weakness

IBM AIX 7.1, 7.2 and AIX VIOS 3.1 could allow a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. IBM X-Force ID: 190911...

CVE-2020-4887

IBM AIX 7.1, 7.2 and AIX VIOS 3.1 could allow a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. IBM X-Force ID: 190911...

PT-2021-12211

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.1 through 7.2 AIX VIOS version 3.1 Description The issue allows a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. Recommendations For IBM AIX versions 7.1 through...

CVE-2021-1246

Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote...

UCMS has a logic flaw vulnerability

UCMS is a content management system written in PHP. UCMS suffers from a logic flaw vulnerability that can be exploited by an attacker to create files and folders under arbitrary paths...

PT-2020-16395

Name of the Vulnerable Software and Affected Versions osquery versions prior to 4.6.0 Description The issue allows someone with administrative access to osquery to cause reads and writes to arbitrary sqlite databases on disk by using sqlite's ATTACH verb. This can lead to the creation of arbitrar...

Design/Logic Flaw

An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software's internal program directory that prevents the Cortex XDR Agent from starting. The exceptional condition is persistent and prevents Cortex XDR...

Privilege escalation

A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory...

CVE-2020-2020

The CVE-2020-2020 issue affects Cortex XDR Agent on Windows, caused by improper handling of exceptional conditions in the agent’s internal directory. This allows a local authenticated user to create files that prevent the agent from starting, with the problem persisting after reboot. Affected ver...

CVE-2020-2020 Cortex XDR Agent: Exceptional condition denial-of-service (DoS)

An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software's internal program directory that prevents the Cortex XDR Agent from starting. The exceptional condition is persistent and prevents Cortex XDR...

NewStart CGSL CORE 5.05 / MAIN 5.05 : okular Vulnerability (NS-SA-2020-0115)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has okular packages installed that are affected by a vulnerability: - okular version 18.08 and earlier contains a Directory Traversal vulnerability in function unpackDocumentArchive... in core/document.cpp that can result in...

PT-2020-15245

Name of the Vulnerable Software and Affected Versions Cortex XDR Agent versions prior to 5.0.10 Cortex XDR Agent versions prior to 6.1.7 Cortex XDR Agent versions prior to 7.0.3 Cortex XDR Agent versions prior to 7.1.2 Description An improper handling of exceptional conditions issue allows a loca...

NewStart CGSL CORE 5.04 / MAIN 5.04 : okular Vulnerability (NS-SA-2020-0076)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has okular packages installed that are affected by a vulnerability: - okular version 18.08 and earlier contains a Directory Traversal vulnerability in function unpackDocumentArchive... in core/document.cpp that can result in...

Authentication Bypass

sddm is vulnerable to authentication bypass. The X server allows unprivileged users to create a connection to the server without authentication due to an incorrect start and race condition during Xauthority file creation...

Cisco SD-WAN Software Arbitrary File Creation (cisco-sa-vsoln-arbfile-gtsEYxns)

According to its self-reported version, Cisco SD-WAN Software is affected by an arbitrary file creation vulnerability due to insufficient input validation for specific commands. An authenticated, local attacker can exploit this, by including crafted arguments to the vulnerable commands, to create...