Directory Traversal in xtalk

Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL. Example request: http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:localhost Recommendation No patch is currently available for this vulnerability, and t...

GHSA-CQV6-7FWC-8M3C Directory Traversal in xtalk

Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL. Example request: http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:localhost Recommendation No patch is currently available for this vulnerability, and t...

CVE-2020-3520

A vulnerability in Cisco Data Center Network Manager DCNM Software could allow an authenticated, local attacker to obtain confidential information from an affected device. The vulnerability is due to insufficient protection of confidential information on an affected device. An attacker at any...

CVE-2020-14316

A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances VMIs can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any...

Design/Logic Flaw

A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances VMIs can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any...

CVE-2020-14316

CVE-2020-14316 – mode C Affected software: kubevirt (VMIs) prior to 0.29.0. Root cause: insufficient isolation controls between VMIs and host, enabling a VM process to access the host filesystem. Impact: attacker can gain the privileges of the VM on the host, potentially reading and modifying any...

CVE-2020-14316

A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances VMIs can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any...

CVE-2020-14316

A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances VMIs can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any...

UBUNTU-CVE-2020-8933

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using the membership to the "lxd" group, an attacker can attach host devices and filesystems. Within ...

CVE-2020-3336

A vulnerability in the software upgrade process of Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software could allow an authenticated, remote attacker to modify the filesystem to cause a denial of service DoS or gain privileged access to the root filesystem. The vulnerabili...

CVE-2020-1963

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...

Code injection

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10...

CVE-2020-2023

Kata Containers CVE-2020-2023: Root filesystem access was not restricted, enabling potential code execution on the guest and masquerading as the kata-agent. Affected: Kata Containers 1.11.x before 1.11.1; 1.10.x before 1.10.5; 1.9 and earlier. Remediation: upgrade to fixed releases (e.g., 1.11.1 ...

GHSA-5WM5-8Q42-RHXG File system access via H2 in Apache Ignite

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...

CVE-2020-1963

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...

CVE-2020-1963

Apache Ignite (which uses H2 for its distributed SQL execution) has a vulnerability where H2 SQL functions could be abused to access the filesystem. The connected advisories corroborate that this vulnerability involves file-system access via H2 within Ignite. No exploit specifics, affected versio...

CVE-2020-1963

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem...

The vulnerability of the Cisco Firepower Management Center’s software management web interface allows a perpetrator to rerecord files in the file system of the vulnerable device.

The vulnerability of the Cisco Firepower Management Center software’s web interface exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to re-write files in the file system of the vulnerable device using a specially created file...

[ASA-202005-1] salt: multiple issues

Arch Linux Security Advisory ASA-202005-1 ========================================= Severity: Critical Date : 2020-05-05 CVE-ID : CVE-2020-11651 CVE-2020-11652 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1147 Summary ======= The package salt before...

CVE-2020-11701

An issue was discovered in ProVide formerly zFTPServer through 13.1. CSRF exists in the User Web Interface, as demonstrated by granting filesystem access to the public for uploading and deleting files and directories...