829 matches found
CVE-2019-18837
An issue was discovered in crun before 0.10.5. With a crafted image, it doesn't correctly check whether a target is a symlink, resulting in access to files outside of the container. This occurs in libcrun/linux.c and libcrun/chrootrealpath.c...
CVE-2013-1809
Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directories...
Design/Logic Flaw
Hadoop 1.0.3 contains a symlink vulnerability...
Amazon Linux 2 : keepalived (ALAS-2019-1323)
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protectedsymlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or...
Medium: keepalived
Issue Overview: keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protectedsymlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data...
keepalived: Improper pathname validation allows for overwrite of arbitrary filenames via symlinks
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protectedsymlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or...
CVE-2019-11230
CVE-2019-11230 affects Avast Antivirus prior to 19.4. A local administrator can exploit a symlink in Logs\Update.log to cause the product to rename arbitrary files. The next write to the log file renames the symlink target and can be used to rename a critical binary (e.g., AvastSvc.exe), leading ...
ALPINE-CVE-2019-13636
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c...
CVE-2019-13636
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c...
SUSE SLED15 / SLES15 Security Update : libu2f-host, pam_u2f (SUSE-SU-2019:1750-1)
This update for libu2f-host and pamu2f to version 1.0.8 fixes the following issues : Security issues fixed for libu2f-host : CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response bsc1128140. Security issues fixed for pamu2f: CVE-2019-12209: Fixed an issue where symlinks in th...
DEBIAN-CVE-2019-12209
Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile default $HOME/.config/Yubico/u2fkeys as root unless openasuser was enabled, and does not properly verify that the path lacks symlinks pointing to other files on the system owned by root. If the debug option is enabled in the PAM...
CVE-2019-9949
Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution as root, starting from a low-privilege user session vulnerability. The cgi-bin/webfilemgr.cgi file allows arbitrary file write by...
CVE-2019-5438
Path traversal using symlink in npm harp module versions = 0.29.0...
Information Disclosure
serve-handler is vulnerable to information disclosure attacks. The vulnerability exists as symlinks were enabled by default, and were being resolved during runtime...
Unauthorized File Access
Overview Affected versions of harp are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server. Recommendation Upgrade to version 0.40.3...
Node.js third-party modules: [harp] Path traversal using symlink
In reference to 453820 Module module name: harp version: 0.29.0 npm page: https://www.npmjs.com/package/harp Module Description zero-configuration web server with built in pre-processing Module Stats 2,679 downloads in the last week Vulnerability Path traversal using symlink. Vulnerability...
CVE-2018-19044
CVE-2018-19044 applies to keepalived 2.0.8, where improper pathname validation allows local users to overwrite arbitrary files via symlinks when writing to a temporary file (examples: /tmp/keepalived.data or /tmp/keepalived.stats symlinked to /etc/passwd) if fs.protected_symlinks is 0. Connected ...
Linux systemd Symlink Dereference Via chown_one()
systemd: chownone can dereference symlinks CVE-2018-15687 I am sending this bug report to Ubuntu, even though it's an upstream bug, as requested at https://github.com/systemd/systemd/blob/master/docs/CONTRIBUTING.mdsecurity-vulnerability-reports . When chownone in the recursive chown logic decide...
Jekyll allows attackers to access arbitrary files by specifying a symlink
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the include key in the config.yml file...