463 matches found
samba: smb client vulnerable to filenames containing path separators
A flaw was found in the samba client where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working...
CVE-2018-9159
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark...
CVE-2019-5251
There is a path traversal vulnerability in several Huawei smartphones. The system does not sufficiently validate certain pathnames from the application. An attacker could trick the user into installing, backing up and restoring a malicious application. Successful exploit could cause information...
SUSE-SU-2019:3019-1 Security update for the Linux Kernel (Live Patch 9 for SLE 12 SP4)
This update for the Linux Kernel 4.12.14-9537 fixes one issue. The following security issue was fixed: - CVE-2019-10220: Added sanity checks on the pathnames passed to the user space bsc1153108...
CVE-2019-16951
A remote file include RFI issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amou...
SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2953-1)
The SUSE Linux Enterprise 15-SP1 Azure Kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine...
PT-2019-14883
Name of the Vulnerable Software and Affected Versions Enghouse Web Chat version 6.2.284.34 Description A remote file include issue was discovered, allowing an attacker to replace the localhost attribute with their own domain name. After a POST request is sent, the product calls this domain,...
SUSE-SU-2019:2950-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Excepti...
Design/Logic Flaw
A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this...
USN-4167-2: Samba vulnerabilities
USN-4167-1 fixed several vulnerabilities in Samba. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Michael Hanselmann discovered that the Samba client code incorrectly handled path separators. If a user were tricked into connecti...
Unspecified vulnerability in Samba (CNVD-2019-39841)
Samba is a set of free software from the Samba team that enables UNIX series operating systems to connect to the SMB/CIFS network protocol of Microsoft Windows operating systems. The program supports sharing printers, transferring data files to each other, and so on. A security vulnerability exis...
CVE-2019-17400
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion...
unoconv package code issue vulnerability
The unoconv package is a software package for document format conversion. A code issue vulnerability vulnerability exists in versions of the unoconv package prior to 0.9, which stems from unoconv failing to properly handle untrustworthy pathnames, no details of the vulnerability are provided at...
DEBIAN-CVE-2019-17400
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion...
CVE-2019-17400
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion...
PYSEC-2019-213
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion...
CVE-2019-17400
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion...
PYSEC-2019-213
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion...
