CVE-2020-1752

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially...

CVE-2020-1752

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially...

The vulnerability of the Vijeo Designer Basic and Vijeo Designer software lies in errors during the validation of the paths for loading dynamic libraries. This allows a hacker to execute arbitrary code.

The vulnerability of the Vijeo Designer Basic and Vijeo Designer software lies in errors during the validation of the paths for loading dynamic libraries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

F5 Networks BIG-IP : BIG-IP restjavad vulnerability (K94325657)

The restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server. CVE-2020-5880 Impact A remote attacker may be able to fill the disk storage and make the...

SSRF in OIDC Setup [Bitbucket Data Center]

h3. Issue Summary SSRF h3. Steps to Reproduce During set-up of a custom OpenID Connect identity provider in Bitbucket Server but may apply to other Data Center applications that use the same OIDC module|https://hub.docker.com/r/atlassian/bitbucket-server/, one has to specify the "Issuer URL". As...

GOG GalaxyClientService Privilege Escalation

This module will send arbitrary filepaths to the GOG GalaxyClientService, which will be executed with SYSTEM privileges verified on GOG Galaxy Client v1.2.62 and v2.0.12; prior versions are also likely affected. Module Options msf use exploit/windows/local/gog/galaxyclientserviceprivesc msf...

The vulnerability of the zipfileUpdate() function in the SQLite database management system allows a hacker to cause a service failure.

The vulnerability of the zipfileUpdate function in the SQLite database management system is related to the improper handling of NULL paths during the update of zip archives. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

Prusa Research PrusaSlicer _3MF_Importer::_handle_end_model() use-after-free vulnerability

Summary A use-after-free vulnerability exists in the 3MFImporter::handleendmodel functionality of Prusa Research PrusaSlicer 2.2.0 and Master commit 4b040b856. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Tested...

CVE-2020-5569

An unquoted search path vulnerability exists in HDD Password tool for Windows version 1.20.6620 and earlier which is stored in CANVIO PREMIUM 3TBHD-MB30TY, HD-MA30TY, HD-MB30TS, HD-MA30TS, CANVIO PREMIUM 2TBHD-MB20TY, HD-MA20TY, HD-MB20TS, HD-MA20TS, CANVIO PREMIUM 1TBHD-MB10TY, HD-MA10TY,...

Toshiba Electronic Devices & Storage software registers unquoted service paths

Overview Some of Toshiba Electronic Devices & Storage software registers Windows services with unquoted file paths CWE-428. Toshiba Electronic Devices & Storage Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and TOSHIBA ELECTRONIC DEVIC...

JVN#13467854: Toshiba Electronic Devices & Storage software registers unquoted service paths

Some of Toshiba Electronic Devices & Storage software registers Windows services with unquoted file paths CWE-428. Impact When a registered path contains spaces, and a malicious executable is placed on a certain path, it may be executed with the privilege of the Windows service. Solution The...

CVE-2020-11883

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...

CVE-2020-11883

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2020-1452)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unspecified vulnerability in Squid (CNVD-2020-25819)

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in Squid 4.7 and earlier versions. The vulnerability can be exploited by an attacker t...

Microsoft Windows Unquoted Service Path Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/exe' class MetasploitModule 'Windows Unquoted Service Path Privilege Escalation', 'Description' = %q This module exploits a logic flaw due to h...

CVE-2020-11739

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to...

Samsung Mobile Device Path Traversal Vulnerability

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. A path traversal vulnerability exists in Samsung mobile devices, which can be exploited by an attacker to modify the client-server data flow in order to insert a...

Arbitrary Code Execution

elinks is vulnerable to arbitrary code execution. The vulnerability exists as it was discovered that ELinks tried to load translation files using relative paths. A local attacker able to trick a victim into running ELinks in a folder containing specially-crafted translation files could use this...

CentOS 7 : libxml2 (RHSA-2020:1190)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1190 advisory. - The xzdecomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a...