Casdoor 路径遍历漏洞

Casdoor is an open source Identity and Access Management IAM / Single Sign-On SSO platform with a Web UI that supports OAuth 2.0 / OIDC and SAML authentication. A security vulnerability exists in Casdoor v1.97.3, which is caused by an arbitrary file write vulnerability via the fullFilePath...

PT-2022-24495 · Casdoor · Casdoor

Name of the Vulnerable Software and Affected Versions: Casdoor version 1.97.3 Description: The issue is related to an arbitrary file write vulnerability. This vulnerability can be exploited via the fullFilePath parameter at the "/api/upload-resource" API endpoint. Recommendations: For Casdoor...

CLSA-2022-1662658348 Fixed CVE-2022-29154 in rsync

CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync server MITM attack, refactoring - fix test-system components, enable 'daemon' and 'hardlinks' tests...

Fixed CVE-2022-29154 in rsync

CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync server MITM attack, refactoring - fix test-system components, enable 'daemon' and 'hardlinks' tests...

CLSA-2022-1662658181 Fixed CVE-2022-29154 in rsync

CVE-2022-29154: fix arbitrary file write vulnerability via malicious rsync server MITM attack, refactoring - fix test-system components, enable 'daemon' and 'hardlinks' tests...

CLSA-2022-1662658118 Fix CVE(s): CVE-2022-29154

SECURITY UPDATE: arbitrary file write vulnerability via malicious rsync server MITM attack, refactoring - debian/patches/CVE-2022-29154-0.patch: prepare for CVE-2022-29154 patch - debian/patches/CVE-2022-29154-1.patch: add extra file-list safety checks - CVE-2022-29154...

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example a crafted file name) this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote low privileged attacker to force zgrep to write arbitrary files on the system.

...

RHEL 9 : gzip (RHSA-2022:4582)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:4582 advisory. The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing t...

GLSA-202209-01 : GNU Gzip, XZ Utils: Arbitrary file write

The remote host is affected by the vulnerability described in GLSA-202209-01 GNU Gzip, XZ Utils: Arbitrary file write - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can...

Arbitrary File Write

spark-core is vulnerable to arbitrary file write. Lack of explicit checking of existence of source file in Utils.unpack before calling the method FileUtil.unTar of Hadoop which has a loophole in handling of missing .tar files...

The vulnerability of the Rsync file transfer and synchronization utility, related to authentication errors, allows a hacker to write arbitrary files.

The vulnerability of the Rsync file transfer and synchronization utility is related to authentication errors. Exploiting this vulnerability allows a remote attacker to write arbitrary files...

SUSE: Security Advisory (SUSE-SU-2022:2959-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-34373

Dell Command | Integration Suite for System Center, versions prior to 6.2.0, contains arbitrary file write vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability in order to perform an arbitrary write as system...

CVE-2022-34373

Dell Command | Integration Suite for System Center, versions prior to 6.2.0, contains arbitrary file write vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability in order to perform an arbitrary write as system...

Design/Logic Flaw

Dell Command | Integration Suite for System Center, versions prior to 6.2.0, contains arbitrary file write vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability in order to perform an arbitrary write as system...

CVE-2022-34373

CVE-2022-34373 affects Dell Command | Integration Suite for System Center (vulnerable: prior to 6.2.0). The vulnerability is an arbitrary file write undermining the ability of a locally authenticated user to perform writes as SYSTEM. Affected component is the Dell Command | Integration Suite for ...

CVE-2022-34373

Dell Command | Integration Suite for System Center, versions prior to 6.2.0, contains arbitrary file write vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability in order to perform an arbitrary write as system...

CVE-2022-1271

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation...

ALPINE-CVE-2022-1271

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation...

DEBIAN-CVE-2022-1271

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation...