RUSTSEC-2021-0104 File exposure in pleaser

pleaser before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the searchpath function, the --check option, or the -d option...

File exposure in pleaser

pleaser before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the searchpath function, the --check option, or the -d option...

PT-2021-18239 · Hedgedoc · Hedgedoc

Name of the Vulnerable Software and Affected Versions: HedgeDoc versions prior to 1.5.0 Description: The issue affects HedgeDoc, an open-source collaborative markdown editor, where an attacker can receive arbitrary files from the file system when exporting a note to PDF. This exploit requires the...

CVE-2021-28168

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...

OESA-2021-1122 velocity-tools security update

The VelocityTools project is a collection of useful Java classes aka tools, as well as infrastructure to easily, automatically and transparently make these tools available to Velocity templates. Project include easy integration of Velocity into the view-layer of web applications via the...

Arbitrary File Read Vulnerability in Doco Document Management System (CNVD-2021-27651)

DuoKe document management system is for the enterprise to provide a safe, easy to use B / S architecture integrated system, through the system to complete the integration of enterprise document storage, sub-group folder display, full-text search of document content, document preview, download and...

Insecure Default

Overview Affected versions of this package are vulnerable to Insecure Default. Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately...

CVE-2021-24031

In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions matching the input would only be set at completion time. Output files could therefore be readable or writable to unintended parties...

PT-2021-14570 · Dell Emc · Dell Openmanage Server Administrator

Name of the Vulnerable Software and Affected Versions: Dell EMC OpenManage Server Administrator OMSA versions 9.5 and prior Description: The issue allows a remote user with admin privileges to potentially view arbitrary files on the target system by sending a specially crafted URL request. This c...

CVE-2021-0337

In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-...

CVE-2021-0337

In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-...

Code injection

In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-...

CVE-2021-0337

In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-...

CVE-2021-0337

CVE-2021-0337 affects Android (8.1–11) via moveInMediaStore in FileSystemProvider.java. A stale-metadata file exposure could enable local escalation of privilege with User execution privileges; exploitation does not require user interaction. Public technical details are limited in the provided do...

CVE-2021-20358

IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. This information could be obtained by a user with permissions to read log files. IBM X-Force ID: 194965...

IBM Cloud Pak for Automation 日志信息泄露漏洞

IBM Cloud Pak for Automation is an intelligent software platform for building automation applications in cloud environments from IBM USA. The platform uses pre-integrated automation technologies and low-code tools to design, build and run automation applications and services on any cloud. A...

CVE-2021-20359

IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive information in log files that could be obtained by an unauthorized user. IBM X-Force ID: 194966...

ASB-A-157474195

In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2020-23162

Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read a session-file and obtain plain-text user credentials...

PT-2021-7656 · Asus · Asus Rt-Ac68U

Name of the Vulnerable Software and Affected Versions: ASUS RT-AC68U router firmware versions prior to 3.0.0.4.386.41634 Description: The issue is related to a SQL injection vulnerability in the Cloud Disk feature of the ASUS RT-AC68U router firmware. This vulnerability allows remote attackers to...