The vulnerability of the endpoint of the Cisco Application Policy Infrastructure Controller, related to access control deficiencies, allows a hacker to write arbitrary files.

The vulnerability of the endpoint of the Cisco Application Policy Infrastructure Controller API is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to write arbitrary files...

Huawei HarmonyOS 路径遍历漏洞

Huawei HarmonyOS is an operating system from Huawei, China. A security vulnerability exists in a component of Huawei HarmonyOS, which provides a microkernel-based, fully-scoped distributed operating system. An attacker can exploit the vulnerability to write files arbitrarily with systemapp...

CVE-2021-41578

mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead ...

CVE-2021-41578

mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write arbitrary files to OS locations where the user has permission. This would typically lead ...

USN-5102-1 mercurial vulnerabilities

It was discovered that Mercurial mishandled symlinks in subrepositories. An attacker could use this issue to write arbitrary files to the target’s filesystem. CVE-2019-3902 It was discovered that Mercurial incorrectly handled certain manifest files. An attacker could use this issue to cause a...

PT-2021-23343

Name of the Vulnerable Software and Affected Versions mySCADA myDESIGNER versions 8.20.0 and below Description The issue allows Directory Traversal attacks when importing project files. If an attacker can trick a victim into importing a malicious mep file, then they gain the ability to write...

Server-Side Request Forgery (SSRF) in appwrite/appwrite

Description An authenticated SSRF vulnerability exists in appwrite's webhooks / tasks feature. The gopher:// protocol can be used to cause code execution on the Redis server that comes along with appwrite. The attacker must know the IP address of the redis-server which can be done by creating...

The vulnerability of software for modeling, designing, and drawing in AutoCAD, related to the disclosure of information in error-prone areas of data, allows attackers to write arbitrary files.

The vulnerability of software for modeling, designing, and drawing in AutoCAD is related to the disclosure of information in the erroneous data area when processing DWG files. Exploiting this vulnerability can allow attackers to write arbitrary files...

USN-5078-2 squashfs-tools vulnerabilities

USN-5078-1 fixed several vulnerabilities in Squashfs-Tools. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Etienne Stalmans discovered that Squashfs-Tools mishandled certain malformed SQUASHFS files. An attacker could use this vulnerability to write...

Adobe Incopy 缓冲区错误漏洞

Adobe InCopy is a professional word processing program from Adobe that is integrated with Adobe InDesign. Adobe InCopy 16.3.1, 16.3 and earlier versions are vulnerable to a memory out-of-bounds access vulnerability. An attacker could exploit the vulnerability to achieve arbitrary file system writ...

CVE-2021-39134

@npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder...

CVE-2021-38573

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated...

CVE-2021-38565

An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows writing to arbitrary files via submitForm...

CVE-2021-38573

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated...

Foxit PDF Reader和Foxit PDF Editor 安全漏洞

Foxit PDF Reader and Foxit PDF Editor are both products of Foxit China. Foxit PDF Reader is a PDF reader and Foxit PDF Editor is a PDF editor. A security vulnerability exists in versions prior to 11.0.1, which can be exploited to allow an attacker to write arbitrary files via submitForm...

go-unarr 路径遍历漏洞

go-unarr is an open source go language library for decompressing RAR, TAR, ZIP and 7z archives. go-unarr version 0.1.1 is vulnerable to a directory traversal vulnerability that could be exploited to write arbitrary files on the system via specially crafted TAR archives...

JUMP 路径遍历漏洞

JUMP is an asset management solution from the French company JUMP. version 3.6.0.04.009-2487 of JUMP AMS contains a security vulnerability that stems from the fact that the application allows arbitrary files to be written to a user-controlled location on a remote file system with user-controlled...

PT-2021-20081

Name of the Vulnerable Software and Affected Versions Elements-IT HTTP Commander version 5.3.3 Description A Directory Traversal issue in the Unzip feature allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives. Recommendations For Elements-IT...

Echo ShareCare 代码问题漏洞

ShareCare is a clinical and financial software system from Echo Group. A security vulnerability exists in Echo ShareCare version 8.15.5, which stems from the file upload functionality in "Access/DownloadFeedMnt/FileUploadUpd.cfm" that is susceptible to an unrestricted upload vulnerability via the...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from incorrect restrictions on the path to the restricted catalog. This allows attackers to write arbitrary files into the device’s file system.

The vulnerability of the Magento Commerce development and management software platform is related to incorrect restrictions on the path name used to access the restricted catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system...