CVE-2021-35968: Improper Limitation of a Pathname to a Restricted Directory

The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges...

CVE-2021-35967: Improper Limitation of a Pathname to a Restricted Directory

The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the system directory thru Path Traversal without logging in...

PT-2021-11685

Name of the Vulnerable Software and Affected Versions: Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx Description: The issue concerns a file permission vulnerability that could be exploited by a locally authenticated attacker, potentially leading to the disclosure of certain system directory...

Remote Code Execution (RCE)

cms is vulnerable to Remote Code Execution. The vulnerability exists due to the system not restricting administrative permission to save to a Local volume with the File System Path setting set to a system directory after an attacker is able to hijack an administrator's session...

Design/Logic Flaw

The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive information downloaded via the API using the API Client. The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive...

CVE-2020-27643

The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local users to create and modify files in protected directories where they would not normally have access to create or modify files via the creation of a junction point to a system...

Trend Micro Security 2020 Local Elevation of Privilege Vulnerability (CNVD-2020-73785)

Trend Micro Security 2020 is a suite of computer security protection software from Trend Micro. Trend Micro Security 2020 Consumer contains a security vulnerability that can be exploited by an attacker to gain administrative privileges during product installation by placing a specific Windows...

CVE-2020-27696

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27696

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27696

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27696: Undefined Security Weakness

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-5793

A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerabili...

Design/Logic Flaw

A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerabili...

CVE-2020-5793

A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerabili...

Tenable Nessus < 8.12.1 Privilege Escalation Vulnerability (TNS-2020-08)

A vulnerability in Nessus versions 8.9.0 through 8.12.0 could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerability by creating a malicious file and copying the file to...

mail/dovecot -- multiple vulnerabilities

Aki Tuomi reports: When imap hibernation is active, an attacker can cause Dovecot to discover file system directory structure and access other users' emails using specially crafted command. The attacker must have valid credentials to access the mail server. Mail delivery / parsing crashed when th...

CVE-2020-3920

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3920

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3920 Unisoon UltraLog Express - Broken Authentication

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3920

CVE-2020-3920 affects the UltraLog Express device management interface (Unisoon) where access authentication is not properly enforced on certain pages/functions, enabling any user to reach a privileged page for managing accounts via a system directory. Multiple sources (NVD, CNVD, CVE records, an...