The vulnerability of the Global Protect Agent for Windows’ security software suite lies in the lack of quotation marks in the code for elements or search paths, allowing attackers to gain system privileges.

The vulnerability of the Global Protect Agent for Windows software lies in the absence of quotation marks in the code for elements or search paths. Exploiting this vulnerability can allow an attacker to gain system privileges...

CVE-2020-15113

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...

CVE-2020-15113

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...

CVE-2020-15113

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...

Design/Logic Flaw

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...

CVE-2020-15113

CVE-2020-15113 affects etcd where os.MkdirAll creates certain directories (etcd data dir and TLS cert dir) with 700 when they don’t yet exist, but does not perform permission checks if the path already exists. The vulnerability allows bypassing access restrictions due to lack of permission checks...

CVE-2020-15113

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...

CVE-2020-15113 Improper Preservation of Permissions in etcd

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...

rollup-plugin-serve path traversal vulnerability

rollup-plugin-serve is a module bundler package for JavaScript. A security vulnerability exists in the readFile operation of the 'readFileFromContentBase' function in rollup-plugin-server, which stems from the program's failure to clean up paths. No details of the vulnerability are available at...

CVE-2020-4534

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute...

Code injection

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute...

CVE-2020-4534

CVE-2020-4534 (WebSphere Application Server) is confirmed in connected IBM bulletins. Affected: WebSphere Application Server traditional versions 7.0, 8.0, 8.5, and 9.0. Description: local authenticated attackers can escalate privileges by exploiting improper handling of UNC paths when scheduling...

Debian DSA-4738-1 : ark - security update

Dominik Penner discovered that the Ark archive manager did not sanitise extraction paths, which could result in maliciously crafted archives writing outside the extraction directory. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

[SECURITY] [DSA 4738-1] ark security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4738-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 31, 2020 https://www.debian.org/security/faq -...

rollup-plugin-dev-server path traversal vulnerability

rollup-plugin-dev-server is a plugin summary package. A path traversal vulnerability exists in the readFile operation of the 'readFileFromContentBase' function in rollup-plugin-dev-server all versions, which stems from the program's failure to clean up paths, and can be exploited by an attacker t...

CVE-2020-12027

All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to leverage this information for reconnaissance efforts. Rockwell Automation recommends enabling built in security features found within...

Design/Logic Flaw

All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to leverage this information for reconnaissance efforts. Rockwell Automation recommends enabling built in security features found within...

openSUSE: Security Advisory for xen (openSUSE-SU-2020:0985-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-9252

HUAWEI Mate 20 versions earlier than 10.1.0.160C00E160R3P8, HUAWEI Mate 20 X versions earlier than 10.1.0.135C00E135R2P8, HUAWEI Mate 20 RS versions earlier than 10.1.0.160C786E160R3P8, and Honor Magic2 smartphones versions earlier than 10.1.0.160C00E160R2P11 have a path traversal vulnerability...

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:1902-1)

This update for xen fixes the following issues : CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking bsc1173377. CVE-2020-15565: Fixed insufficient cache write-back under VT-d bsc1173378. CVE-2020-15566: Fixed incorrect error handling in event channel port allocation bsc1173376...