Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2020-36519)

Roundcube Webmail is an open source browser-based IMAP client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in the include/rcmailoutputhtml.php file in Roundcube Webmail versions prior to 1.3.12 and 1.4.x versions...

Directory traversal

An issue was discovered in Navigate CMS through 2.8.7. It allows Directory Traversal because lib/packages/templates/template.class.php mishandles ../ and ..\ substrings...

Schneider Electric EcoStruxure Operator Terminal Expert SQL Injection Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A SQL injection vulnerability exists in the handling of VXDZ files in Schneider Electr...

PT-2020-6837 · Unknown +1 · Postgresql +1

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions 9.5 through 12 Description: The issue is related to the Windows installer for PostgreSQL, which invokes system-provided executables without fully-qualified paths. This allows executables in the directory where the installe...

DEBIAN-CVE-2020-12278

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352...

CVE-2018-18356

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Directory Traversal

github.com/containers/buildah is vulnerable to directory traversal. The image building process does not properly handle file path as well as symlinks. An attacker is able to exploit the vulnerability to overwrite arbitrary files on the file system and potentially escalation privileges by...

The vulnerability of the Windows Background Intelligent Transfer Service, a file transfer service between the client and the HTTP server, allows a hacker to escalate their privileges.

The vulnerability of the Windows Background Intelligent Transfer Service, which is responsible for intelligent file transfer between clients and Windows HTTP servers, is related to errors in processing links that point to file and directory paths. Exploiting this vulnerability can allow an attack...

SUSE-SU-2020:0527-1 Security update for mariadb

This update for mariadb fixes the following issues: MariaDB was updated to version 10.0.40-3 bsc1162388. Security issues fixed: - CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client bsc1162388. - CVE-2019-18901: Fixed an unsafe path handling...

SUSE-SU-2020:0505-1 Security update for mariadb

This update for mariadb fixes the following issues: MariaDB was updated to version 10.2.31 GA bsc1162388. Security issues fixed: - CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client bsc1162388. - CVE-2019-18901: Fixed an unsafe path handling...

CVE-2020-3153

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths...

Security update for samba (moderate)

openSUSE Security Update: Security update for samba Announcement ID: openSUSE-SU-2020:0122-1 Rating: moderate References: 1141320 1160850 1160852 1160888 Cross-References: CVE-2019-14902 CVE-2019-14907 CVE-2019-19344 Affected Products: openSUSE Leap 15.1 An update that solves three vulnerabilitie...

SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2020:0223-1)

This update for samba fixes the following issues : Security issues fixed : CVE-2019-14907: Fixed a Server-side crash after charset conversion failure during NTLMSSP processing bsc1160888. CVE-2019-14902: Fixed an issue where automatic replication of ACLs down subtree on AD Directory is not workin...

Unspecified Vulnerability in CKEditor Image Uploader and Browser

CKEditor is a set of open source, web-based text editor. Image Uploader and Browser is one of the image upload and download plugin. A security vulnerability exists in the pluginconfig.php file in versions of Image Uploader and Browser prior to 4.1.9 used in CKEditor, which stems from the program...

USN-4201-1 ruby2.3, ruby2.5 vulnerabilities

It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this issue to pass path matching what can lead to an unauthorized access. CVE-2019-15845 It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could use this issue to...

PT-2019-4524 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig version 3.9.3 Description: The issue is related to errors in handling HTTP requests in the ajaxArchiveFiles.php component of the rConfig utility for managing network device configurations. Exploitation of this issue may allow a remote...

Debian: Security Advisory (DSA-4552-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-4553-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4166-2 php5 vulnerability

USN-4166-1 fixed a vulnerability in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain paths when being used in FastCGI configurations. A remote attacker could possibly use...

Debian DSA-4553-1 : php7.3 - security update

Emil Lerner and Andrew Danau discovered that insufficient validation in the path handling code of PHP FPM could result in the execution of arbitrary code in some setups. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...