Airspan AirSpot 5410 代码问题漏洞

The Airspan AirSpot 5410 is an advanced LTE, CAT12, outdoor, multi-service product from Airspan USA. A security vulnerability exists in the Airspan AirSpot 5410 version 0.3.4.1-4 and prior versions, which originates from an unauthenticated attacker who can overwrite any file on the system or uplo...

Vulnerability fixed in rsync

A vulnerability has been fixed in rsync. The vulnerability allows a malicious person to overwrite arbitrary files on the victim's system. To exploit this vulnerability exploitation, the victim must connect to a rogue rsync server. The developers of rsync have created a new version to fix the...

Streamlit 路径遍历漏洞

Streamlit is a data-oriented Python application development framework from the Streamlit open source. A path traversal vulnerability exists in Streamlit versions prior to 1.11.1, which stems from being a data-oriented python application development framework, and users hosting Streamlit...

PT-2022-4063 · Unknown · Velociraptor

Name of the Vulnerable Software and Affected Versions: Velociraptor versions prior to 0.6.5-2 Description: The issue is related to incorrect link resolution before accessing a file, which may allow an attacker to overwrite arbitrary files. On MacOS and Linux, it may be possible to perform a symli...

Rockwell Automation ISaGRAF Workbench 路径遍历漏洞

Rockwell Automation ISaGRAF Workbench is a complete programming environment for developing highly portable applications from Rockwell Automation. A path traversal vulnerability exists in Rockwell Automation ISaGRAF Workbench versions 6.0 through 6.6.9, which stems from a crafted malicious file th...

Apple macOS Big Sur 输入验证错误漏洞

Apple macOS Big Sur is the 17th major release of Apple's macOS for MAC operating system from Apple USA. Apple macOS Big Sur suffers from an input validation error vulnerability that stems from an application that may be able to overwrite arbitrary files...

ABB Automation Builder Platform Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of ABB Automation Builder Platform. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Huawei EulerOS: Security Advisory for gzip (EulerOS-SA-2022-2109)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The software for configuring, testing, and deploying Schneider Electric EcoStruxure Power Commission is vulnerable due to incorrect restrictions on the path to the restricted access catalog. This allows attackers to create or overwrite critical files and execute arbitrary code.

The vulnerability of the software used for configuring, testing, and deploying Schneider Electric EcoStruxure Power Commission involves incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to create or re-record...

CVE-2022-20812

Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco...

CVE-2022-20813

Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco...

CVE-2022-20813

Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco...

CVE-2022-20812

Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco...

CVE-2022-20813 Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities

Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco...

CVE-2022-20813

CVE-2022-20813 affects Cisco Expressway Series (Expressway-C/Expressway-E) and Cisco TelePresence Video Communication Server (VCS). The flaw is a null byte poisoning vulnerability arising from improper certificate validation, enabling a remote attacker to mount a Man‑in‑the‑Middle and gain unauth...

CVE-2022-20812

CVE-2022-20812 affects Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS). It enables an authenticated remote attacker with Administrator read-write privileges to trigger path traversal and overwrite arbitrary files via the cluster database API due to insufficient inp...

CVE-2022-20812

Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco...

CVE-2022-2145 Cloudlfare WARP Arbitrary File Overwrite

Cloudflare WARP client for Windows up to v. 2022.5.309.0 allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files...

python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py

A flaw was found in the pip package installer for Python when downloading or installing a remote package via a specified URL. Improper validation of the "Content-Disposition" HTTP response header makes a path traversal attack possible, leading to an arbitrary file overwrite. This flaw allows an...

nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

A flaw was found in the npm package "tar" aka node-tar. Extracting tar files that contain both a directory and a symlink with the same name, where the symlink and directory names in the archive entry used backslashes as a path separator, made it possible to bypass node-tar symlink checks on...