Arbitrary File Write in bin-links

Versions of bin-links prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended nodemodules folder through the bin field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite fil...

GHSA-GQF6-75V8-VR26 Arbitrary File Write in bin-links

Versions of bin-links prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended nodemodules folder through the bin field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite fil...

PT-2020-21316

Name of the Vulnerable Software and Affected Versions bin-links versions prior to 1.1.5 Description The issue allows attackers to create arbitrary files in the system through the bin field, due to a failure to restrict access to folders outside of the intended node modules folder. It is not...

PT-2020-20962

Name of the Vulnerable Software and Affected Versions bin-links versions prior to 1.1.5 Description The issue allows attackers to create symlinks to files outside of the node modules folder through the bin field, potentially granting access to unauthorized files. Recommendations Upgrade to versio...

PT-2020-21504

Name of the Vulnerable Software and Affected Versions bin-links versions prior to 1.1.6 Description The issue allows globally-installed binaries to be overwritten by other package installs. For instance, if a package was installed globally and created a serve binary, any subsequent installs of...

CVE-2020-25079

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddnsenc.cgi allows authenticated command injection...

Command injection

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddnsenc.cgi allows authenticated command injection...

CVE-2020-25079: Improper Neutralization of Special Elements used in a Command

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddnsenc.cgi allows authenticated command injection...

Linux/x86 execve /bin/sh Shellcode (10 bytes)

Exploit Title: Linux/x86 - execve "/bin/sh" 10 bytes Google Dork: None Exploit Author: cybersaki Vendor Homepage: None Software Link: None Version: None Tested on: Kali linux 2020.2a i386 x86 CVE : none Shellcode-length : 10 SLAE-id : Purchased | email protected Reference :...

CVE-2020-15145

In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios. 1. A local regular user may modify the existing C:\ProgramData\ComposerSetup\bin\composer.bat in order to get elevated comma...

CVE-2019-19455

Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / WowzaStreamingEngine / manager / bin / in the Linux version of the server by writing arbitrary commands in any file and execute them as root. This issue was...

PT-2020-21687

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details about the crash include the string scan range, get strings range, and r bin file g...

VulnCheck KEV: CVE-2013-2578

cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in 1 the ServerName parameter and 2 other unspecified...

PT-2020-22471

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 4 crash has been reported. The crash state includes functions such as load, r bin object new, and r bin file new from buffer...

PT-2020-22282

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read crash. Technical details include the crash type being a Heap-buffer-overflow READ 4, and the crash stat...

PT-2020-22407

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a negative-size-param, as reported by OSS-Fuzz. The crash occurs in the following functions: r buf read, bin pe g...

PT-2020-22377

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions check buffer, r bin get binplugin by buffer, and get plugin from...

PT-2020-22376

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow WRITE crash has been reported, involving the bin pe get certificate function. The crash state includes buf bytes read and r buf read...

CVE-2020-15415: Improper Neutralization of Special Elements used in an OS Command

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472...

PT-2020-21832

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-use-after-free READ 8 crash has been reported. The crash involves the functions r bin object rebuild classes ht, r bin object set items, and r bin...