Directory traversal

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. StickerProvider allows directory traversal for access to system files. The Samsung ID is SVE-2020-17665 July 2020...

CVE-2020-15583

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. StickerProvider allows directory traversal for access to system files. The Samsung ID is SVE-2020-17665 July 2020...

CVE-2020-15583

This CVE pertains to Samsung mobile devices running O(8.x), P(9.0), and Q(10.0) where the StickerProvider allows directory traversal to access system files. Root cause: improper validation in the StickerProvider component enables path traversal that could lead to exposure of sensitive files. The ...

CVE-2020-12782

Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment will be triggered and gain unauthorized access to system files...

CVE-2020-12782

Openfind MailGates contains a Command Injection flaw, when receiving email with specific strings, malicious code in the mail attachment will be triggered and gain unauthorized access to system files...

VulnCheck KEV: CVE-2019-7195

QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files...

VulnCheck KEV: CVE-2019-7194

QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files...

Secure Computing SnapGear Management Console SG560 v3.1.5 Arbitrary File Read/Write

Summary The SG gateway appliance range provides Internet security and privacy of communications for small and medium enterprises, and branch offices. It simply and securely connects your office to the Internet, and with its robust stateful firewall, shields your computers from external threats...

Critical SAP ASE Flaws Allow Complete Control of Databases

Researchers are urging users to apply patches for several critical vulnerabilities in SAP’s Adaptive Server Enterprise ASE. If exploited, the most severe flaws could give unprivileged users complete control of databases and – in some cases – even underlying operating systems. ASE previously known...

Directory Traversal

spring-cloud-config-server is vulnerable to directory traversal. The vulnerability exists as it does not verify that the resources are served from allowed locations. An attacker is able to retrieve and read arbitrary system files using file:// or ../ characters...

CVE-2019-15709

An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI...

Input validation

An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI...

CVE-2019-15709

An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI...

CVE-2019-15709

CVE-2019-15709 concerns Fortinet FortiAP-S/W2 (versions 6.2.0–6.2.2, 6.0.5 and below) and FortiAP-U (6.0.1 and below). The issue is an improper input validation in the FortiAP CLI admin console that may allow unauthorized administrators to overwrite system files using specially crafted tcpdump co...

Arbitrary file deletion vulnerability in beescms

BEESCMS is a scalable content management system CMS based on PHP and MySQL. An arbitrary file deletion vulnerability exists in beescms, which can be exploited by an attacker to delete system files...

Fortinet FortiAP-S, FortiAP-W2 and FortiAP-U Input Validation Error Vulnerability

Fortinet FortiAP-S and others are a controller for managing wireless access point devices from Fortinet. An input validation error vulnerability exists in the FortiAP CLI management console in FortiAP-S, FortiAP-W2, and FortiAP-U. An attacker could exploit this vulnerability to overwrite system...

FortiAP system files overwrite via the tcpdump CLI command

...

Palo Alto Networks PAN-OS 7.1.x < 8.1.13 / 8.0.x < 8.1.13 / 8.1.x < 8.1.13 / 9.0.x < 9.0.7 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 8.1.13 or 8.0.x prior to 8.1.13 or 8.1.x prior to 8.1.13 or 9.0.x prior to 9.0.7. It is, therefore, affected by a vulnerability. - A predictable temporary file vulnerability in PAN-OS allows a local authenticate...

CVE-2020-13149

Dragon Center (MSI) on MSI Gaming laptops is affected by CVE-2020-13149 due to weak ACLs on the %PROGRAMDATA%\MSI\Dragon Center folder in versions before 2.6.2003.2401. A local authenticated attacker can overwrite system files and escalate privileges, with attack approaches including replacing th...

Arbitrary File Download Vulnerability in AVCON6 System Management Platform of Huaping Information Technology Co.

Huaping Information Technology Co., Ltd. is a provider of video products and applications, mastering video processing, video and audio coding and decoding, and network adaptability. The AVCON6 system management platform of Huaping Information Technology Co., Ltd. suffers from an arbitrary file...