GHSA-MQ47-6WWV-V79W Path traversal in claircore

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution...

PT-2022-10660 · Clair · Clair

Name of the Vulnerable Software and Affected Versions: Clair versions affected versions not specified Description: A directory traversal issue in the ClairCore engine allows an attacker to exploit the system by providing a crafted container image. When scanned by Clair, this can lead to arbitrary...

CVE-2021-43070

Multiple relative path traversal vulnerabilities CWE-23 in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

Path traversal

Multiple relative path traversal vulnerabilities CWE-23 in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

CVE-2021-43070

Multiple relative path traversal vulnerabilities CWE-23 in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

CVE-2021-43070

CVE-2021-43070 describes multiple relative path traversal vulnerabilities in the Fortinet FortiWLM management interface. Affected versions include FortiWLM 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2. The underlying issue allows an authenticated attacker to retrieve ...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2022-1308)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-25010

The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system...

GHSA-CHXF-FJCF-7FWP Possible filesystem space exhaustion by local users

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt v0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable. Fo...

Possible filesystem space exhaustion by local users

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt v0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable. Fo...

kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL

A data leak flaw was found in the way XFSIOCALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them...

Denial Of Service (DoS)

github.com/google/fscrypt is vulnerable to denial of service DoS attacks. A local attacker is able to exhaust filesystem space because the library creates a world-writable directory by default when setting up a filesystem, causing the application to crash...

FortiWLM - Path traversal vulnerability

Multiple relative path traversal vulnerabilities CWE-23 in FortiWLM management interface may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

Stepmania 安全漏洞

Stepmania is a game from the Stepmania team available for Windows, Linux and OS X. Stepmania is vulnerable to an elevation of privilege vulnerability that stems from a lack of privilege restrictions in the rootfs component of RageFile, which could be exploited to access the entire file system...

GSD-2022-1000604 udf: Fix NULL ptr deref when converting from inline format

udf: Fix NULL ptr deref when converting from inline format This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.5 by commit...

GHSA-MPQ4-RJJ8-FJPH Uncontrolled Resource Consumption in github.com/google/fscrypt

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable...

Uncontrolled Resource Consumption in github.com/google/fscrypt

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable...

CVE-2022-25326

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable...

Design/Logic Flaw

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable...

CVE-2022-25326 Denial of Service in fscrypt

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable...