CVE-2020-3915

A path handling issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to overwrite arbitrary files...

Path traversal

A path handling issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to overwrite arbitrary files...

CVE-2020-9994

CVE-2020-9994 is an Apple libxpc path handling vulnerability that could allow a malicious app to overwrite arbitrary files. The issue is addressed by Apple in updates for multiple platforms: iOS 13.5, iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5. Connected documents provide...

CVE-2020-9994

A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to overwrite arbitrary files...

CVE-2020-9920

A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, watchOS 6.2.8. A malicious mail server may overwrite arbitrary mail files...

CVE-2020-9920

CVE-2020-9920 describes a path handling issue in Apple Mail that could allow a malicious mail server to overwrite arbitrary mail files. The issue is fixed by Apple in iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, and watchOS 6.2.8, addressing improper validation of mail file handling. NVD metada...

CVE-2020-3915

CVE-2020-3915 is a local path-handling vulnerability in Apple macOS Printing that could allow a malicious, locally running app to overwrite arbitrary files. The issue is caused by improper path handling in the Printing component and is addressed by macOS Catalina 10.15.4 (Security Update 2020-002...

CVE-2020-3915

A path handling issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to overwrite arbitrary files...

Ubuntu: Security Advisory (USN-4561-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4561-1: Rack vulnerabilities

It was discovered that Rack incorrectly handled certain paths. An attacker could possibly use this issue to obtain sensitive information. CVE-2020-8161 It was discovered that Rack incorrectly validated cookies. An attacker could possibly use this issue to forge a secure cookie. CVE-2020-8184...

USN-4561-1 ruby-rack vulnerabilities

It was discovered that Rack incorrectly handled certain paths. An attacker could possibly use this issue to obtain sensitive information. CVE-2020-8161 It was discovered that Rack incorrectly validated cookies. An attacker could possibly use this issue to forge a secure cookie. CVE-2020-8184...

USN-4548-1 libuv1 vulnerability

It was discovered that libuv incorrectly handled certain paths. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

The vulnerability of the Control Center-I, related to improper handling of the search path, allows a perpetrator to elevate their privileges.

The vulnerability of Control Center-I is related to incorrect processing of the search path. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2020-4534

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute...

The vulnerability of the uninstaller component of the Cisco AnyConnect Secure Mobility Client for Mac OS allows a perpetrator to influence the integrity of files.

The vulnerability of the uninstaller component of the Cisco AnyConnect Secure Mobility Client for Mac OS relates to improper handling of paths leading to directories. Exploiting this vulnerability can allow an attacker to influence the integrity of files through a specially created symbolic link...

CVE-2020-7668

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

CVE-2020-7668

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

jenkins: CSRF protection bypass via crafted URLs

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL...

CVE-2020-7664

The CVE-2020-7664 issue affects the Go package github.com/unknwon/cae/zip, specifically the ExtractTo function. The vulnerability arises because ExtractTo does not securely escape file paths in zip archives that contain leading or non-leading “..”, enabling path traversal that could allow an atta...

Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2020-36519)

Roundcube Webmail is an open source browser-based IMAP client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in the include/rcmailoutputhtml.php file in Roundcube Webmail versions prior to 1.3.12 and 1.4.x versions...