9326 matches found
CVE-2021-23391
CVE-2021-23391 affects all versions of the NodeJS CMS calipso . The vulnerability is an Arbitrary File Write via Archive Extraction (Zip Slip) , exploitable through the module install functionality to overwrite files on the target filesystem. Root cause appears to be unsafe archive extraction all...
CVE-2021-23391
This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality...
PT-2021-15485
Name of the Vulnerable Software and Affected Versions calipso affected versions not specified Description The issue allows a malicious module to overwrite files on an arbitrary file system through the module install functionality. Recommendations At the moment, there is no information about a new...
CVE-2021-23391: Improper Limitation of a Pathname to a Restricted Directory
This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality...
Calipso: All path traversal vulnerabilities
Calipso is a simple NodeJS content management system. Built on themes similar to Drupal and Wordpress, it is designed to be fast, flexible and simple. calipso has a security vulnerability that can be exploited by an attacker to overwrite files on any file system...
CWE-379 in fabric-sdk-rest version All released versions (project is now archived)
In Hyperledger fabric-sdk-rest version All released versions project is now archived a CWE-379 exists in the packages/fabric-rest/fabric-rest-server script that can be attacked via Local resulting in File overwrite from a privileged user...
GSD-2021-1000003 CWE-379 in fabric-sdk-rest version All released versions (project is now archived)
In Hyperledger fabric-sdk-rest version All released versions project is now archived a CWE-379 exists in the packages/fabric-rest/fabric-rest-server script that can be attacked via Local resulting in File overwrite from a privileged user...
Acronis True Image Arbitrary File Overwrite Vulnerability
Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. The software can be used to create drive and disk images and can restore images when a clean system is needed.Acronis True Image 2020 version 24.5.22510 contains an arbitrary file overwrite...
CVE-2020-28407
A flaw was found in swtpm. This flaw allows an attacker to create a symbolic link with the name of the temporary file TMP2-00.permall for TPM 2 and have this point to a valuable file, which will get overwritten by swtpm. The success of the attack depends on the attacker having access to the TPM's...
Acronis True Image backlink vulnerability
Acronis True Image is a well-known data backup and restore software from Singapore-based Acronis. The software can be used to create drive and disk images and can restore images when a clean system is needed.Acronis True Image 2020 version 24.5.22510 contains an arbitrary file overwrite...
Path traversal and files overwrite with unsquashfs in singularity
Impact Due to insecure handling of path traversal and the lack of path sanitization within unsquashfs a distribution provided utility used by Singularity, it is possible to overwrite/create any files on the host filesystem during the extraction of a crafted squashfs filesystem. Squashfs extractio...
PT-2021-18837
Name of the Vulnerable Software and Affected Versions macOS versions prior to 11.4 Security Update versions prior to 2021-004 Mojave Description A malicious application may be able to overwrite arbitrary files due to an issue with path validation logic for hardlinks. This issue was addressed with...
Local privilege escalation due to improper soft link handling
The issue could allow local users or malicious software to overwrite arbitrary files on the system. Workarounds Disable Acronis Active Protection service...
Mohamed Dief Discord-Recon Code Injection Vulnerability (CNVD-2021-37748)
Mohamed Dief Discord-Recon is a Mohamed Dief open source application. It is used to perform the reconnaissance process b from Discord. A code injection vulnerability exists in Discord-Recon version 0.0.3 and earlier versions, which can be exploited by a remote attacker to be able to overwrite any...
Rockwell Automation Connected Components Workbench path traversal vulnerability
Rockwell Automation CCW is an HMI editor and component-level industrial product for designing and configuring applications and performing microcontroller turns. A path traversal vulnerability exists in Rockwell Automation Connected Components Workbench, which can be exploited by an attacker to...
CVE-2021-1512
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite arbitrary files in the underlying file system of an affected system. This vulnerability is due to insufficient validation of the user-supplied input parameters of a specific CLI command. ...
DEBIAN-CVE-2020-28014
Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten...
USN-4938-1: Unbound vulnerabilities
It was discovered that Unbound contained multiple security issues. A remote attacker could possibly use these issues to cause a denial of service, inject arbitrary commands, execute arbitrary code, and overwrite local files...
USN-4938-1 unbound vulnerabilities
It was discovered that Unbound contained multiple security issues. A remote attacker could possibly use these issues to cause a denial of service, inject arbitrary commands, execute arbitrary code, and overwrite local files...
Cisco Firepower Threat Defense Software Command File Overwrite (cisco-sa-ftd-file-overwrite-XknRjGdB)
According to its version and configuration, the Cisco Firepower Threat Defense FTD Software running on the remote device is affected by a file overwrite vulnerability due to insufficient validation of user input. An authenticated, local attacker can exploit this, by logging in and issuing a craft...