294 matches found
PT-2019-6385
Name of the Vulnerable Software and Affected Versions Git for Visual Studio affected versions not specified Description A tampering issue exists due to improper handling of virtual drive paths by Git for Visual Studio. This issue may allow a remote attacker to write arbitrary files to the system...
The numerous vulnerabilities in the API interface of the WADashboard component of the Advantech WebAccess software allow a perpetrator to write or overwrite any files in the file system.
The multiple vulnerabilities of the API interface of the WADashboard component in the Advantech WebAccess remote monitoring software are related to deficiencies in path validation before its use in file operations. Exploiting these vulnerabilities could allow a malicious actor to read arbitrary...
CVE-2019-18212
XMLLanguageService.java in XML Language Server aka lsp4xml before 0.9.1, as used in Red Hat XML Language Support aka vscode-xml before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal...
The vulnerability of the Cisco RoomOS operating system, related to permission handling errors, allows a intruder to write arbitrary files to the device’s file system.
The vulnerability of the Cisco RoomOS operating system is related to permission handling errors. Exploiting this vulnerability allows an attacker to write arbitrary files to the device’s file system with root privileges...
CVE-2019-14751
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in an NLTK package ZIP archive that is mishandled during extraction...
CVE-2019-10185
It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break o...
CVE-2019-14452
Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in a ZIP archive entry that is mishandled during extraction...
PT-2019-5499
Name of the Vulnerable Software and Affected Versions Sigil versions prior to 0.9.16 Description The issue exists due to incorrect restriction of the path name to a directory with limited access. This can be exploited by a remote attacker to write arbitrary files to any directory. The vulnerabili...
PT-2019-4592
Name of the Vulnerable Software and Affected Versions Huawei PC Manager versions prior to 9.0.1.66 Oversea Huawei PC Manager versions prior to 9.0.1.70 China Description The issue is related to insufficient access control in the Huawei PC Manager application, allowing an attacker to execute...
CVE-2018-19586
Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the...
CVE-2019-1765
A vulnerability in the web-based management interface of Session Initiation Protocol SIP Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficient input validation and file-level...
PT-2019-1720
Name of the Vulnerable Software and Affected Versions Cisco IP Phone 8800 Series versions prior to 11.05 for Wireless IP Phone 8821 and 8821-EX Cisco IP Phone 8800 Series versions prior to 12.51SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series Description A vulnerabili...
PT-2018-14307
Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue allows a local attacker to traverse directories on the system by exploiting a "Zip-Slip" vulnerability. This can be achieved by persuading a victim to extract a...
Directory traversal
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...
CVE-2018-1000544
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...
CVE-2018-1000544
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...
CVE-2018-1000544: Improper Link Resolution Before File Access
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...
PT-2018-9363
Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.121 Jenkins LTS versions prior to 2.107.3 Description A path traversal issue exists that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing security protections. This is due t...
The vulnerability of the dbman service of the HPE Intelligent Management Center PLAT software platform allows a perpetrator to write arbitrary files and execute arbitrary code.
The vulnerability of the dbman service of the HPE Intelligent Management Center PLAT software platform is related to the improper processing of the Opcode 10010 request. Exploiting this vulnerability allows a remote attacker to write arbitrary files and execute arbitrary code...