curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

...

CVE-2020-8177

CVE-2020-8177 affects curl up to 7.70.0, where -J/--remote-header-name combined with -i/--include could allow a malicious server to overwrite a local file due to improper restriction of file names. Connected advisories confirm this vulnerability across distributions (Debian, CentOS, Alpine, Amazo...

CVE-2020-28864

Buffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or possibly have other unspecified impact via a long file name...

Vulnerability fixed in Drupal

A vulnerability has been fixed in Drupal core. Drupal core does not handle some file names correctly. As a result, it is possible for files to be misinterpreted and executed under the wrong MIME type or executed as PHP. This applies to a number of configurations; which ones these are is not...

QNAP Systems TS-870 Cross-Site Scripting Vulnerability

QNAP Systems TS-870 is a NAS Network Attached Storage appliance from China Weilian QNAP Systems. A cross-site scripting vulnerability exists in the File Name of Music Station in the QNAP Systems TS-870 using firmware version 4.3.4.0486. The vulnerability stems from a lack of proper validation of...

CVE-2020-28328

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled .php file under the web root...

CVE-2020-28328

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled .php file under the web root...

Remote code execution

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled .php file under the web root...

CVE-2020-28328

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root. This is a high-severity issue (CVE-2020-28328)...

PT-2020-16975 · Salesagility · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.11.17 Description: The issue allows for remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, the logger file name can refer to an...

Samba 3.6.x < 4.11.15 / 4.12.x < 4.12.9 / 4.13.x < 4.13.1 Multiple Vulnerabilities

The version of Samba running on the remote host is 3.6.x prior to 4.11.15, 4.12.x prior to 4.12.9, or 4.13.x prior to 4.13.1. It is, therefore, potentially affected by multiple vulnerabilities, including the following: - A null pointer dereference flaw was found in samba's Winbind service in...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Samba vulnerabilities (USN-4611-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4611-1 advisory. Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue...

F2fs-Tools F2fs.Fsck Multiple Devices Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability...

Kentico CMS 9.0-12.0.49 - Persistent Cross Site Scripting

Exploit Title: Kentico CMS 9.0-12.0.49 - Persistent Cross Site Scripting Exploit Author: Ataberk YAVUZER CVE: CVE-2019-19493 Type: Webapps Vendor Homepage: https://www.kentico.com/ Version: 9.0-12.0.49 Date: 29-11-2019 CVE Details: https://nvd.nist.gov/vuln/detail/CVE-2019-19493 Details Persisten...

openSUSE Security Update : virtualbox (openSUSE-2020-1486)

This update for virtualbox fixes the following issues : Update to Oracle version 6.1.14a. This minor update enables the building of libvirt again. Version update to 6.1.14 released September 04 2020 by Oracle File 'fixvirtiobuild.patch' is added to fix a build problem. This is a maintenance...

Hyland OnBase Directory Traversal Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability to read a file via the FileName parameter...

Hyland OnBase Directory Traversal Vulnerability (CNVD-2020-51794)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability to write to a file via the FileName parameter...

PT-2020-16033 · Hyland · Onbase

Name of the Vulnerable Software and Affected Versions: Hyland OnBase versions prior to 18.0.0.33 and versions 19.x through 19.8.9.1000 Description: An issue exists where directory traversal is possible, allowing writing to files. This is demonstrated through the FileName parameter. Recommendation...

CVE-2020-25104

eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example, the filename has a complete XSS payload followed by the .png extension...

The command-line interface of SUSE Linux Enterprise Software Development Kit and SUSE Linux Enterprise Module for Development Tools exposes clients to vulnerabilities, allowing attackers to exploit these privileges.

The vulnerability of the command-line interface of SUSE Linux Enterprise Software Development Kit and SUSE Linux Enterprise Module for Development Tools relates to improper external management of file names or paths. Exploiting this vulnerability can allow a malicious actor to gain increased...