680 matches found
OPENSUSE-SU-2021:0846-1 Security update for umoci
This update for umoci fixes the following issues: Update to v0.4.7 bsc1184147. - CVE-2021-29136: Fixed overwriting of host files via malicious layer bsc1184147. This update was imported from the SUSE:SLE-15:Update update project...
Path Traversal in MHolt Archiver
All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. It is exploited using a specially crafted zip archive, that holds path traversal filenames. When exploited, a filename in a malicious archive is concatenated to the target extraction directory, whi...
Check Point Identity Agent Backlink Vulnerability
Check Point Identity Agent is an application from Check Point USA. It is used to obtain and report identities to the Check Point Identity Awareness Security Gateway. A back-link vulnerability exists in versions prior to Check Point Identity Agent R81.018.0000, which allows a less privileged user ...
CVE-2021-29465
Discord-Recon is a bot for the Discord chat service. Versions of Discord-Recon 0.0.3 and prior contain a vulnerability in which a remote attacker is able to overwrite any file on the system with the command results. This can result in remote code execution when the user overwrite important files ...
GO-2020-0034 Path traversal in github.com/artdarek/go-unzip
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
OPENSUSE-SU-2021:0548-1 Security update for umoci
This update for umoci fixes the following issues: - Update to umoci v0.4.6. - CVE-2021-29136: malicious layer allows overwriting of host files bsc1184147 This update was imported from the SUSE:SLE-15:Update update project...
Path Traversal
github.com/ipfs/go-ipfs is vulnerable to path traversal. The use of whyrusleeping/tar-utils which fails to validate tarPath when a get is done on an malicious DAG file allows overwritting of files or writing to incorrect destination folders during retrieval...
CVE-2021-21068
Adobe Creative Cloud Desktop Application version 5.3 and earlier is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user interaction...
CVE-2021-21068
Adobe Creative Cloud Desktop Application version 5.3 and earlier is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user interaction...
Design/Logic Flaw
Adobe Creative Cloud Desktop Application version 5.3 and earlier is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user interaction...
CVE-2021-21068: Creation of Temporary File in Directory with Insecure Permissions
Adobe Creative Cloud Desktop Application version 5.3 and earlier is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user interaction...
NewStart CGSL CORE 5.04 / MAIN 5.04 : curl Multiple Vulnerabilities (NS-SA-2021-0018)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has curl packages installed that are affected by multiple vulnerabilities: - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. CVE-2019-5482 - curl 7.20.0 through 7.70.0 is vulnerable to improper...
PT-2021-2517
Name of the Vulnerable Software and Affected Versions Adobe Creative Cloud Desktop Application versions 5.3 and earlier Description The issue is related to the creation of temporary files with insecure permissions in the Adobe Creative Cloud Desktop Application. Exploitation of this issue could...
container-tools:2.0 security update
buildah 1.11.6-8.0.1 - Reduce unnecessary writable mounts in NaiveDiffDriver Orabug: 31025483 - Fixes troubles with oracle registry login Orabug: 29937283 1.11.6-8 - exclude i686 arch - Related: 1821193 1.11.6-7 - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file...
Zero-day vulnerabilities in Microsoft Exchange Server
What happened? On March 2, 2021 several companies released reports about in-the-wild exploitation of zero-day vulnerabilities inside Microsoft Exchange Server. The following vulnerabilities allow an attacker to compromise a vulnerable Microsoft Exchange Server. As a result, an attacker will gain...
PT-2021-2212
Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description The issue is related to insufficient input validation in Microsoft Exchange Server, which can be exploited by a remote attacker to overwrite arbitrary files in the system...
Remote code execution
A file extension handling issue was found in server module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain remote code executi...
CVE-2021-25833
A file extension handling issue was found in server module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain remote code executi...
CVE-2021-25833
A file extension handling issue was found in server module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain remote code executi...
CVE-2021-25833
A file extension handling issue was found in server module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain remote code executi...