CVE-2020-16602: Concurrent Execution using Shared Resource with Improper Synchronization

Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a race condition in which a file created under "%PROGRAMDATA%\Razer Chroma\SDK\Apps" can be replaced before it is executed by the server. The attacker must have access to port 54236...

A Google Drive 'Feature' Could Let Attackers Trick You Into Installing Malware

An unpatched security weakness in Google Drive could be exploited by malware attackers to distribute malicious files disguised as legitimate documents or images, enabling bad actors to perform spear-phishing attacks comparatively with a high success rate. The latest security issue—of which Google...

CVE-2020-6012

ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links. This allows an...

PT-2020-18887 · Zonealarm · Zonealarm Anti-Ransomware

Name of the Vulnerable Software and Affected Versions: ZoneAlarm Anti-Ransomware versions prior to 1.0.713 Description: The issue allows a sophisticated timed attacker to replace files with malicious content, enabling an unprivileged user to escalate privileges via local access. This can be...

cae input validation error vulnerability (CNVD-2021-25664)

cae is a compression/decompression software package. An input validation error vulnerability exists in the ExtractTo feature in all versions of cae, which stems from the program failing to properly escape the path to a file in a zip archive, and can be exploited by an attacker to add or replace...

UBUNTU-CVE-2020-7668

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

The vulnerability of the Buildah command-line tool arises from an incorrect path limitation for the restricted access directory. This allows a malicious actor to create a malicious container image and replace arbitrary files on the user’s system.

The vulnerability of the Buildah command-line tool exists due to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to create a malicious container image and replace arbitrary files on the user’s system...

CVE-2020-7668

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2020-7664

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2020-7664: Improper Limitation of a Pathname to a Restricted Directory

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

PT-2020-19692

Name of the Vulnerable Software and Affected Versions github.com/unknwon/cae/zip affected versions not specified Description The ExtractTo function does not securely escape file paths in zip archives, which include leading or non-leading "..". This allows an attacker to add or replace files...

CVE-2020-9046

A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files...

CVE-2020-9046: Improper Access Control

A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files...

PT-2020-20459

Name of the Vulnerable Software and Affected Versions Kantech EntraPass Editions affected versions not specified Description A vulnerability could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files...

Opto 22 SoftPAC Project Code Issue Vulnerability

Opto 22 SoftPAC Project is an automation software suite from Opto 22 USA. The product is capable of providing industrial automation, process control, building automation, remote monitoring, data acquisition and industrial IoT. A code issue vulnerability exists in Opto 22 SoftPAC Project 9.6 and...

PT-2020-13012

Name of the Vulnerable Software and Affected Versions Opto 22 SoftPAC Project versions 9.6 and prior Description The issue concerns the lack of verification of firmware files' signatures during updates, allowing an attacker to replace legitimate firmware files with malicious ones. Recommendations...

Unauthorized Replacement

SeaMonkey is vulnerable to unauthorized replacement. Due to a law found in the way SeaMonkey creates temporary file names for downloaded files. If a local attacker knows the name of a file SeaMonkey is going to download, they can replace the contents of that file with arbitrary contents...

CVE-2019-5469

An IDOR vulnerability exists in GitLab v12.1.2, v12.0.4, and v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets...

Code injection

An IDOR vulnerability exists in GitLab v12.1.2, v12.0.4, and v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets...

CVE-2019-5469

An IDOR vulnerability exists in GitLab v12.1.2, v12.0.4, and v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets...