PT-2022-16797 · Hashicorp · Nomad Enterprise +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Nomad and Nomad Enterprise versions 0.9.2 through 1.0.17 HashiCorp Nomad and Nomad Enterprise version 1.1.11 HashiCorp Nomad and Nomad Enterprise version 1.2.5 Description: The issue allows operators with read-fs and alloc-exec or...

Nomad alloc Filesystem and Container Escape

Summary Nomad and Nomad Enterprise “Nomad” allows operators with read-fs and alloc-exec or job-submit capabilities to read arbitrary files on the host filesystem as root through the Nomad client agent. This vulnerability, CVE-2022-24683, was fixed in Nomad 1.0.18, 1.1.12, and 1.2.6. Background...

CVE-2022-22790

SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The path exposes sensitive files that users...

Directory traversal

SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The path exposes sensitive files that users...

CVE-2022-22790 SYNEL - eharmony Directory Traversal

SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The path exposes sensitive files that users...

The vulnerability of the orchestration program for Kubernetes containerized applications, related to deficiencies in access control, allows a attacker to circumvent the established security restrictions.

The vulnerability of the Kubernetes tool is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions by creating containers with attached volumes for accessing files and directories outside of the volume, including in th...

PYSEC-2021-873

Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access an...

CVE-2021-35245

When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine...

SolarWinds Serv-U File Server 安全漏洞

Solarwinds SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A security vulnerability exists in the SolarWinds Serv-U File Server that allows a user with administrator privileges in the Serv-U console to move, create, and delete any file that is accessible on the Serv-U...

baserCMS 路径遍历漏洞

baserCMS is an enterprise content management system CMS from the baserCMS Basercms team. baserCMS is vulnerable to a path traversal vulnerability that allows an attacker with upload privileges to upload a crafted zip file capable of path traversal on the host operating system...

Medium: containerd

Issue Overview: A flaw was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host's filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to...

Important: docker

Issue Overview: A flaw was discovered in the API endpoint behind the 'docker cp' command. The endpoint is vulnerable to a Time Of Check to Time Of Use TOCTOU vulnerability in the way it handles symbolic links inside a container. An attacker who has compromised an existing container can cause...

Important: docker

Issue Overview: A flaw was discovered in the API endpoint behind the 'docker cp' command. The endpoint is vulnerable to a Time Of Check to Time Of Use TOCTOU vulnerability in the way it handles symbolic links inside a container. An attacker who has compromised an existing container can cause...

YouPHPTube 代码注入漏洞

YouPHPTube is a PHP-based video website system. YouPHPTube has a security vulnerability that originates from an administrator privileged user being able to write files on the file system using flags and code variables in file save.php...

Medium: docker

Issue Overview: A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host 2019s filesystem, widening access to others. This bug does not directly allow files to ...

DEBIAN-CVE-2021-41089

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem,...

USN-5100-1 containerd vulnerability

It was discovered that containerd insufficiently restricted permissions on container root and plugin directories. If a user or automated system were tricked into launching a specially crafted container image, a remote attacker could traverse directory contents and modify files and execute program...

Docker Engine 安全漏洞

Docker Engine is a set of lightweight runtime environment and package management tools from Docker Inc. in the United States. A security vulnerability exists in Docker Engine that stems from the fact that copying files into a crafted container using docker cp may result in changes to Unix file...

UBUNTU-CVE-2021-41089

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem,...

Kubernetes 输入验证错误漏洞

Kubernetes is an open source Docker container cluster management system from the American Linux Foundation. The system provides resource scheduling, deployment operations, service discovery, and scale-up and scale-down for containerized applications. kubernetes has a security vulnerability that c...