GHSA-MR7P-25V2-35WR NLTK Vulnerable To Path Traversal

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in an NLTK package ZIP archive that is mishandled during extraction...

PT-2019-3241

Name of the Vulnerable Software and Affected Versions NLTK Downloader versions prior to 3.4.5 Description The issue is related to a directory traversal vulnerability, allowing attackers to write arbitrary files via a ../ dot dot slash in an NLTK package ZIP archive that is mishandled during...

PT-2019-12215

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.13.9 Kubernetes versions prior to 1.14.5 Kubernetes versions prior to 1.15.2 Kubernetes versions 1.1, 1.2, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12 Description The issue arises from the kubectl cp command,...

The vulnerability of the IcedTea-Web plugin, related to an incorrect limitation on the path name to the restricted access catalog, allows a hacker to write arbitrary files to the device’s file system.

The vulnerability of the IcedTea-Web plugin is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files to the device’s file system using a specially crafted file in formats: .tar, .jar, .war,...

DEBIAN-CVE-2019-14452

Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in a ZIP archive entry that is mishandled during extraction...

USN-4055-1 flightcrew vulnerabilities

Mike Salvatore discovered that FlightCrew improperly handled certain malformed EPUB files. An attacker could potentially use this vulnerability to cause a denial of service. CVE-2019-13032 Mike Salvatore discovered that FlightCrew mishandled certain malformed EPUB files. An attacker could use thi...

PT-2019-5201 · Flightcrew +1 · Flightcrew +1

Name of the Vulnerable Software and Affected Versions: FlightCrew versions 0.9.2 and older Description: The issue is related to insufficient input validation in the EPUB validator, allowing attackers to write arbitrary files via a ../ dot dot slash in a ZIP archive entry that is mishandled during...

The vulnerability of the command-line interface of Cisco UCS Blade Series B software allows a hacker to write arbitrary files.

The vulnerability of the command-line interface of Cisco UCS Blade series B micro-programming system software is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to write arbitrary files by modifying the command-line interface parameters...

Pulse Secure Pulse Connect Secure Path Traversal Vulnerability

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. A security vulnerability exists in Network File Share NFS in Pulse Secure PCS. An attacker could exploit this vulnerability to write arbitrar...

CVE-2019-3398

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

PT-2019-11293

Name of the Vulnerable Software and Affected Versions: kubectl versions prior to 1.11.9 kubectl versions prior to 1.12.7 kubectl versions prior to 1.13.5 kubectl versions prior to 1.14.0 Description: The issue arises from the kubectl cp command, which allows copying files between containers and t...

NVIDIA Arbitrary File Writes to Command ExecutionCVE-2019-5674

The post NVIDIA Arbitrary File Writes to Command Execution CVE-2019-5674 appeared first on Rhino Security Labs...

Arbitrary File Writes And Directory Creation

System.IO.Compression.ZipFile is vulnerable to arbitrary file writes and directory creation. The vulnerability can be triggered because it does not properly validate the trailing separator for nested paths...

Microsoft Windows 10 - DSSVC MoveFileInheritSecurity Privilege Escalation

Microsoft Windows 10 - DSSVC MoveFileInheritSecurity Privilege Escalation Windows: DSSVC MoveFileInheritSecurity Multiple Issues EoP Platform: Windows 10 1803 and 1809. Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary NOTE: This is one of multip...

Microsoft Windows 10 - DSSVC MoveFileInheritSecurity Privilege Escalation

Windows: DSSVC MoveFileInheritSecurity Multiple Issues EoP Platform: Windows 10 1803 and 1809. Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary NOTE: This is one of multiple issues I’m reporting in the same service. While I’ve tried to ensure al...

Arbitrary File Writes And Directory Creation

microsoft.netcore.app System.IO.Compression.ZipFile is vulnerable to arbitrary file writes and directory creation. The vulnerability can be triggered because it does not properly validate the trailing separator for nested paths...

Command execution vulnerability in OTCMS backend te***.php file

Nettitanium Article Management System OTCMS is an asp article management system. There is a command execution vulnerability in the OTCMS background te.php file. An attacker can exploit the vulnerability to write arbitrary files and execute arbitrary commands...

Multiple Roche Device Privilege Permission and Access Control Vulnerabilities

The Roche Accu-Chek Inform II Instrument, among others, is a handheld blood testing medical device from Roche, Switzerland. A device permission and access control vulnerability exists in the software update mechanism of several Roche devices, which is caused due to a failure of the program to...

Arbitrary File Writes

Jodd Core is susceptible to arbitrary file writes. It is possible because it does not validate the file parameter to avoid the access to the rootDir and to write the file...

openSUSE Security Update : ant (openSUSE-2018-1057)

This update for ant fixes the following issues : Security issue fixed : - CVE-2018-10886: Fixed a path traversal vulnerability in malformed zip file paths, which allowed arbitrary file writes and could potentially lead to code execution bsc1100053 This update was imported from the...