PT-2019-5499

Name of the Vulnerable Software and Affected Versions Sigil versions prior to 0.9.16 Description The issue exists due to incorrect restriction of the path name to a directory with limited access. This can be exploited by a remote attacker to write arbitrary files to any directory. The vulnerabili...

PT-2019-4592

Name of the Vulnerable Software and Affected Versions Huawei PC Manager versions prior to 9.0.1.66 Oversea Huawei PC Manager versions prior to 9.0.1.70 China Description The issue is related to insufficient access control in the Huawei PC Manager application, allowing an attacker to execute...

CVE-2018-19586

Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the...

CVE-2019-1765

A vulnerability in the web-based management interface of Session Initiation Protocol SIP Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficient input validation and file-level...

PT-2019-1720

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 8800 Series versions prior to 11.05 for Wireless IP Phone 8821 and 8821-EX Cisco IP Phone 8800 Series versions prior to 12.51SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series Description A vulnerabili...

PT-2018-14307

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue allows a local attacker to traverse directories on the system by exploiting a "Zip-Slip" vulnerability. This can be achieved by persuading a victim to extract a...

Directory traversal

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...

CVE-2018-1000544

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...

CVE-2018-1000544

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...

CVE-2018-1000544: Improper Link Resolution Before File Access

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...

PT-2018-9363

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.121 Jenkins LTS versions prior to 2.107.3 Description A path traversal issue exists that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing security protections. This is due t...

The vulnerability of the dbman service of the HPE Intelligent Management Center PLAT software platform allows a perpetrator to write arbitrary files and execute arbitrary code.

The vulnerability of the dbman service of the HPE Intelligent Management Center PLAT software platform is related to the improper processing of the Opcode 10010 request. Exploiting this vulnerability allows a remote attacker to write arbitrary files and execute arbitrary code...

CVE-2014-3219

fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on 1 /tmp/fishd.log.%s, 2 /tmp/.pac-cache.$USER, 3 /tmp/.yum-cache.$USER, or 4 /tmp/.rpm-cache.$USER...

CVE-2014-5003

chef/travis-cookbooks/cienvironment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer...

CVE-2017-15894

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager DSM 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15894: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager DSM 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15893: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

PT-2017-14271

Name of the Vulnerable Software and Affected Versions Synology File Station versions prior to 1.1.1-0099 Description The issue allows remote authenticated users to write arbitrary files via the dest folder path parameter in the SYNO.FileStation.Extract function. Recommendations For versions prior...

CVE-2017-15895: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager SRM before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

PT-2017-12499

Name of the Vulnerable Software and Affected Versions Cisco NX-OS System Software affected versions not specified Description A vulnerability in the patch installation process of Cisco NX-OS System Software could allow an authenticated, local attacker to write a file to arbitrary locations. This ...