CVE-2023-31131

Greenplum Database GPDB is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file writes. An attacker can use this...

CVE-2023-31131: Improper Limitation of a Pathname to a Restricted Directory

Greenplum Database GPDB is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file writes. An attacker can use this...

PT-2023-7471

Name of the Vulnerable Software and Affected Versions Greenplum Database versions prior to 6.22.3 Description The issue is related to the Greenplum Database using unsafe methods to extract tar files within GPPKGs, leading to path traversal and arbitrary file writes. An attacker can exploit this t...

AlmaLinux 9 : device-mapper-multipath (ALSA-2023:2459)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:2459 advisory. - multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to...

PT-2023-18260 · Samsung · Samsung Core Service

Name of the Vulnerable Software and Affected Versions: Samsung Core Service versions prior to 2.1.00.36 Description: The issue is related to improper access control in the Samsung Core Service, allowing an attacker to write arbitrary files in the sandbox. Recommendations: For versions prior to...

EulerOS Virtualization 2.9.1 : multipath-tools (EulerOS-SA-2023-1643)

According to the versions of the multipath-tools packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction...

PT-2023-22823 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions 10.8.0 through 10.8.10 Description: The issue is related to a directory traversal vulnerability inside the ClientLogController, specifically /ClientLog/Document. This vulnerability can be combined with a cross-site scripting...

PT-2023-9258

Name of the Vulnerable Software and Affected Versions Gogs versions through 0.13.0 Description The issue is related to argument injection during the previewing of changes, which can allow a remote attacker to execute arbitrary commands. Unprivileged user accounts can write to arbitrary files on t...

The vulnerability of the file loading function of the distributed file system sjqzhang go-fastdfs allows a attacker to write any files and execute any commands.

The vulnerability of the file loading function in the distributed file system sjqzhang go-fastdfs is related to deficiencies in path checking for restricted-access directories. Exploiting this vulnerability allows an attacker to write arbitrary files and execute arbitrary commands remotely...

K000133058: device-mapper-multipath vulnerability CVE-2022-41973

Security Advisory Description multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to...

PT-2023-21678 · Unknown +2 · Stellarium +2

Name of the Vulnerable Software and Affected Versions: Stellarium versions through 1.2 Description: The issue allows attackers to write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal. Recommendations: For Stellarium versions through 1.2,...

EulerOS 2.0 SP9 : multipath-tools (EulerOS-SA-2023-1452)

According to the versions of the multipath-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with...

EulerOS 2.0 SP9 : multipath-tools (EulerOS-SA-2023-1477)

According to the versions of the multipath-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with...

PT-2023-5841 · Triangle Microworks · Triangle Microworks Scada Data Gateway

Name of the Vulnerable Software and Affected Versions: Triangle MicroWorks SCADA Data Gateway affected versions not specified Description: This issue allows remote attackers to write arbitrary files on affected installations, potentially enabling them to execute code in the context of root. The...

SUSE CVE-2005-2095

optionsidentities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS attacks, and write arbitrary files...

SUSE CVE-2010-2251

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

SUSE CVE-2011-2202

The rfc1867posthandler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request...

SUSE CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar iss...

SUSE CVE-2014-7169

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the...

SUSE CVE-2015-0552

Directory traversal vulnerability in the gcabfolderextract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."...