Design/Logic Flaw

Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confidentiality, integrity, and availability of the target machine...

Knime Analytics Platform 安全漏洞

Knime Analytics Platform is a free and open source data analysis, reporting and integration platform from Knime, Switzerland. A security vulnerability previously existed in Knime Analytics Platform version 4.6.0, which stemmed from the Windows installer setting the wrong file system permissions...

CVE-2022-29483 e-Design - Multiple vulnerabilities

Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confidentiality, integrity, and availability of the target machine...

CVE-2022-28702 e-Design - Multiple vulnerabilities

Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confidentiality, integrity, and availability of the target machine...

CVE-2022-29483

Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confidentiality, integrity, and availability of the target machine...

CVE-2021-32935

The affected Cognex product, the In-Sight OPC Server versions v5.7.4 96 and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation...

CVE-2022-0959

A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write...

CVE-2021-43970

An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 1043 via a .mp3;.jsp filename for a file that begins with audio data bytes. It allows an authenticated low privileged attacker to execute remote code on the target server within the context of...

GHSA-34JX-WX69-9X8V Symlink Attack in kubectl cp

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could r...

Microsoft Windows NTFS 权限许可和访问控制问题漏洞

Microsoft Windows NTFS is a file system from Microsoft USA that serves computer files. The file system has error alerts, disk self-healing, and logging capabilities. Microsoft Windows NTFS is vulnerable to privilege permission and access control issues. The following products and editions are...

CVE-2021-40887

Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files parameter, an attacker can add ../ to move all PHP files or any file on the system that has permissions to /upload/files/ folder...

Hms Networks eCatcher Information Disclosure Vulnerability

Hms Networks eCatcher is a VPN Virtual Private Network client application from the Swedish company HMS Networks. Hms Networks eCatcher suffers from a security vulnerability that stems from weak file system permissions that may allow access by malicious users. An attacker could exploit the...

CVE-2021-28570 Adobe After Effects uncontrolled search path element vulnerability could lead to remote code execution

Adobe After Effects version 18.1 and earlier is affected by an Uncontrolled Search Path element vulnerability. An unauthenticated attacker could exploit this to to plant custom binaries and execute them with System permissions. Exploitation of this issue requires user interaction...

CVE-2021-28570 Adobe After Effects uncontrolled search path element vulnerability could lead to remote code execution

Adobe After Effects version 18.1 and earlier is affected by an Uncontrolled Search Path element vulnerability. An unauthenticated attacker could exploit this to to plant custom binaries and execute them with System permissions. Exploitation of this issue requires user interaction...

CVE-2021-22333

There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause code to execute, thus obtaining system permissions...

CVE-2021-22333

There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause code to execute, thus obtaining system permissions...

Input validation

There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause code to execute, thus obtaining system permissions...

CVE-2021-22333

There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause code to execute, thus obtaining system permissions...

CVE-2021-22333

CVE-2021-22333 affects Huawei smartphones due to an improper validation of an array index. The Red Hat, NVD, CVE lists and related records describe that exploiting this flaw could allow code execution and obtain system permissions. The concrete vulnerable target is the array index validation mech...

Kubernetes Security Is Not Container Security

Container-specific security I recently had an interesting discussion with Gianluca Brindisi from Spotify about the differences between Kubernetes security and container security. Typically, the discussion about container security focuses on general questions that aren’t focused on a specific...