CVE-2020-5811: Improper Limitation of a Pathname to a Restricted Directory

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS = 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package...

PT-2020-18728

Name of the Vulnerable Software and Affected Versions Umbraco CMS versions prior to 8.9.2 Description An authenticated path traversal issue exists during package installation, potentially allowing arbitrary files to be written outside expected paths when installing an Umbraco package...

CVE-2020-26277: Improper Link Resolution Before File Access

DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a syst...

Arbitrary File Write

Packwood MPXJ is vulnerable to arbitrary file write. The vulnerability exists because it does not properly validate the path from inputStream, leading to the writing of files outside of the target directory...

CVE-2020-35460: Improper Limitation of a Pathname to a Restricted Directory

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations...

PT-2020-5496 · Packwood · Mpxj

Name of the Vulnerable Software and Affected Versions: Packwood MPXJ versions prior to 8.3.5 Description: The issue exists due to incorrect restriction of the directory path name in the common/InputStreamHelper.java library of MPXJ, allowing a remote attacker to write files to arbitrary locations...

PT-2020-20576

Name of the Vulnerable Software and Affected Versions Spinnaker versions prior to 1.23.4 Spinnaker versions prior to 1.22.4 Spinnaker versions prior to 1.21.5 Description A security issue exists in the handling of SpEL expressions, allowing an attacker to read and write arbitrary files within the...

CVE-2020-9301: Deserialization of Untrusted Data

Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container...

CVE-2020-27833

A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image .tar file which contains symbolic links. The vulnerability is limited to the command oc image extract. If a symbolic link is first...

CVE-2020-9922

A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. Processing a maliciously crafted email may lead to writing arbitrary files...

CVE-2020-9922: Undefined Security Weakness

A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra. Processing a maliciously crafted email may lead to writing arbitrary files...

Arbitrary File Write

LPRng is vulnerable to arbitrary file write. A local unauthenticated attacker could overwrite arbitrary files via a symbolic link attack on the /tmp/before file of the psbanner component...

Rocket.Chat: Server-side RCE through directory traversal-based arbitrary file write

Vulnerability description not provided...

PT-2020-5927

Name of the Vulnerable Software and Affected Versions: QNAP QTS affected versions not specified Description: The issue is related to the implementation of the myupnpmediasvr DLNA server process in QNAP QTS operating systems for network storage devices. It involves insufficient protection of servi...

Arbitrary File Write Vulnerability in Jinhe OA-C6

Jinhe OA system product C6 collaborative management platform has more than 20 application modules, more than 160 application sub-modules, involving enterprise management business including collaborative office management, human resource management, project management, customer relationship...

CVE-2020-15929: Improper Limitation of a Pathname to a Restricted Directory

In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write an arbitrary CFM file within the application's context containing attacker-defined CFML tags, leading to Remote Code Execution...

CVE-2020-25989

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

CVE-2020-25989

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

Privilege escalation

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...

CVE-2020-25989

Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges...