CVE-2021-23521

This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In...

PT-2022-1561 · D Link · Di-7200Gv2.E1

Name of the Vulnerable Software and Affected Versions: D-Link device DI-7200GV2.E1 version 21.04.09E1 Description: The issue is related to a command injection vulnerability in the usb paswd.asp function. This vulnerability allows attackers to execute arbitrary commands via the name parameter. The...

Trend Micro Worry-Free Business Security 后置链接漏洞

Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection solutions from Trend Micro. The product provides anti-spam, anti-virus, network security, and email protection. Trend Micro Worry-Free Business Security suffers from a back-link vulnerability,...

CVE-2021-4144

TP-Link wifi router TL-WR802N V4JP, with firmware version prior to 211202, is vulnerable to OS command injection...

CVE-2021-41057

CVE-2021-41057 affects WIBU CodeMeter Runtime prior to 7.30a. A local attacker can abuse a crafted CmDongles symbolic link to overwrite the target file without permission checks, potentially crashing the CodeMeter Runtime Server and causing DoS. Public documentation confirms affected product is C...

Waimai Super Cms 跨站脚本漏洞

Waimai Super Cms is a takeaway ordering system. A cross-site scripting vulnerability exists in waimai Super Cms, which originates from the product's /admin.php?&m=Public&a=login link failing to properly process input data. An attacker could cause client-side code execution through this...

CVE-2021-41072

squashfsopendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create th...

squashfs-tools 后置链接漏洞

squashfs-tools is an open source software package. A security vulnerability in squashfsopendir in unsquash-2.c in Squashfs-Tools 4.5 arises from the fact that a well-designed squashfs filesystem contains a symbolic link, and then the contents of the same filesystem under the same filename causes...

ROS-2-1755

2.1755 Multiple Exim Server Vulnerabilities 1. Vulnerability description: CVE-2020-28007 A vulnerability in the Exim message forwarding agent, is related to a symbolic link in the Exim log directory. Exploitation of the vulnerability could allow an attacker to create a special symbolic link to a...

ROS-2-2152

2.2152 Multiple Exim Server Vulnerabilities 1. Vulnerability description: CVE-2020-28007 Vulnerability in the Exim message forwarding agent, related to a symbolic link in the Exim log directory. Exploitation of the vulnerability could allow an attacker to create a special symbolic link to a...

ROS-2-1929

2.1929 Multiple Exim Server Vulnerabilities 1. Vulnerability description: CVE-2020-28007 A vulnerability in the Exim message forwarding agent, is related to a symbolic link in the Exim log directory. Exploitation of the vulnerability could allow an attacker to create a special symbolic link to a...

CVE-2021-35938

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system...

Tp-link TP-Link TL-SG2005和TP-Link TL-SG2008 跨站请求伪造漏洞

Tp-link TP-Link TL-SG2005 and TP-Link TL-SG2008 are both switches from China's Tp-link. A cross-site request forgery vulnerability exists in multiple Tp-Link models. The vulnerability stems from the lack of authentication of sensitive URLs within the switch, which allows an attacker to modify...

CVE-2021-30666

creationtimestamp| type| source ---|---|--- 2021-05-04 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=579 2021-05-04 08:13:01+00:00| seen| https://t.me/cKure/5148 2021-09-08 18:42:44+00:00| exploited| https://t.me/cibsecurity/28487 2021-11-08 08:58:17+00:00| seen|...

Check Point Identity Agent 后置链接漏洞

Check Point Identity Agent is an application from Check Point USA. It is used to obtain and report identities to the Check Point Identity Awareness Security Gateway. A back-link vulnerability exists in versions prior to Check Point Identity Agent R81.018.0000, which allows a less privileged user ...

Cisco SD-WAN Denial of Service Vulnerability

The Cisco SD-WAN vEdge is a router from Cisco, Inc. that provides basic WAN and security and multi-cloud capabilities for Cisco SD-WAN solutions. This device provides basic WAN, security, and multi-cloud capabilities for Cisco SD-WAN solutions.Cisco SD-WAN vManage is software from Cisco that...

Sogou Input Method suffers from a local power lifting vulnerability

Sogou Input Method is a Chinese character input method tool. A local privilege elevation vulnerability exists in Sogou Input Method. An attacker can exploit the vulnerability to cause a local privilege boost via a symbolic link...

Remote code execution

JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution...

Stefanberger Swtpm Security Vulnerabilities

Stefanberger Swtpm is a Libtpms-based software emulator from the individual developer Stefanberger. The software supports features such as sockets, character devices and the Linux CUSE interface. A security vulnerability exists in Stefanberger Swtpm versions prior to 0.5.1, which stems from a...

CVE-2020-28935

A symbolic link traversal vulnerability was found in unbound in the way it writes its PID file while starting up. This flaw allows a local attacker with access to the unbound user to set up a link to another file, owned by root, and make unbound overwrite it during its next restart, destroying th...