Design/Logic Flaw

An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory such as C:\ to store a program that can then be unintentionally executed by another local user when that user utilizes ...

Cortex XDR Agent: Unintended Program Execution When Using Live Terminal Session

An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory such as C:\ to store a program that can then be unintentionally executed by another local user when that user utilizes ...

An issue was discovered in ZZIPlib through 0.13.69. There is a memory leak triggered in the function __zzip_parse_root_directory in zip.c which will lead to a denial of service attack.

...

Netgear NETGEAR R6260 缓冲区错误漏洞

The Netgear NETGEAR R6260 is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in the NETGEAR R6260, which can be exploited by an attacker to execute code in the root directory...

USN-5100-1 containerd vulnerability

It was discovered that containerd insufficiently restricted permissions on container root and plugin directories. If a user or automated system were tricked into launching a specially crafted container image, a remote attacker could traverse directory contents and modify files and execute program...

CVE-2021-36717

Synerion TimeNet version 9.21 contains a directory traversal vulnerability where, on the "Name" parameter, the attacker can return to the root directory and open the host file. This might give the attacker the ability to view restricted files, which could provide the attacker with more informatio...

Directory traversal

Synerion TimeNet version 9.21 contains a directory traversal vulnerability where, on the "Name" parameter, the attacker can return to the root directory and open the host file. This might give the attacker the ability to view restricted files, which could provide the attacker with more informatio...

CVE-2021-36717

Synerion TimeNet version 9.21 contains a directory traversal vulnerability where, on the "Name" parameter, the attacker can return to the root directory and open the host file. This might give the attacker the ability to view restricted files, which could provide the attacker with more informatio...

CVE-2021-36717 Synerion TimeNet version 9.21 - Directory Traversal

Synerion TimeNet version 9.21 contains a directory traversal vulnerability where, on the "Name" parameter, the attacker can return to the root directory and open the host file. This might give the attacker the ability to view restricted files, which could provide the attacker with more informatio...

TimeNET 路径遍历漏洞

TimeNET is a software tool for modeling and analyzing random Petri nets with non-exponentially distributed trigger times. A path traversal vulnerability exists in TimeNet 9.21, which stems from the "Name" parameter and allows an attacker to return to the root directory and open the hosts file...

F5 BIG-IP TMUI Unauthorized Access Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. The F5 BIG-IP TMUI Unauthorized Access vulnerability can be exploited by an authenticated attacker by sending a crafted reque...

CVE-2021-3042

A local privilege escalation PE vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. Exploiting this vulnerability requires the user to have file creation privilege in the...

CVE-2021-33540

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists...

CVE-2021-33540

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists...

Design/Logic Flaw

In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists...

CVE-2021-33540

The CVE affects Phoenix Contact AXL F BK and IL BK devices, where an undocumented password-protected FTP access to the root directory exists. The root cause is an insecure/undocumented FTP auth path, enabling access to the device’s root filesystem. The available data indicate a high-severity impa...

Phoenix Contact AXL F BK and IL BK 信任管理问题漏洞

Phoenix Contact AXL F BK PN is a bus coupler from Phoenix Contact, Germany. A security vulnerability exists in the Phoenix Contact AXL F BK and IL BK that stems from the program having undocumented password-protected FTP access to the root directory...

CVE-2021-3041

A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory...

Rainy Novel cms has arbitrary file deletion vulnerability

Wild Rain Fiction cms hereinafter referred to as KYXSCMS provides a lightweight fiction website solution based on ThinkPHP 5.1+MySQL. KYXSCMS has an arbitrary file deletion vulnerability. An attacker can use the vulnerability to delete any file in the root directory...

FreeBSD-SA-21:05.jail_chdir

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:05.jailchdir Security Advisory The FreeBSD Project Topic: jailattach2 relies on the caller to change the cwd Category: core Module: jail Announced: 2021-02-2...