Mozilla: Arbitrary local file access with 'Copy as cURL'

The Mozilla Foundation Security Advisory describes this flaw as: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, i...

Mozilla: Arbitrary local file access with 'Copy as cURL'

The Mozilla Foundation Security Advisory describes this flaw as: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, i...

CVE-2020-12393

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command...

PT-2020-15396 · Jenkins · Jenkins Artifactory Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Copy Artifact Plugin versions 1.43.1 and earlier Description: The issue arises from improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access. This is particularly concerning for...

UBUNTU-CVE-2020-12392

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This...

Accusoft ImageGear TIFF fill_in_raster buffer copy operation code execution vulnerability

Summary An exploitable code execution vulnerability exists in the TIFF fillinraster function of the igcore19d.dll library of Accusoft ImageGear 19.4, 19.5 and 19.6. A specially crafted TIFF file can cause an out-of-bounds write, resulting in remote code execution. An attacker can provide a...

CVE-2020-5873

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy scp utility but does not have access to Advanced Shell bash can execute arbitrary commands...

Cross site request forgery (csrf)

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy scp utility but does not have access to Advanced Shell bash can execute arbitrary commands...

CVE-2019-19216

BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy...

CVE-2019-19216

BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy...

Design/Logic Flaw

BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy...

CVE-2019-19216

BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy...

CVE-2019-19216

The CVE-2019-19216 entry concerns BMC Software Control-M/Agent 7.0.00.000. Connected CNVD data states a vulnerability exists in Control-M/Agent 7.0.00.000 that could allow a remote attacker to overwrite sensitive files and possibly execute commands. The NVD entry identifies an Insecure File Copy ...

How to Use VSSTrace to Collect VSS Diagnostic Logging

Challenge This article explains how to collect additional VSS diagnostic data with the VSSTrace tool, a Microsoft Windows Software Development Kit SDK component. Cause Veeam products use Microsoft Volume Shadow Copy Service VSS for various tasks. Sometimes it is necessary to go through the...

CVE-2020-12103

In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files with .bak extension outside the scope in the same directory in which they are stored...

CVE-2020-12103

In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files with .bak extension outside the scope in the same directory in which they are stored...

CVE-2020-12103

In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files with .bak extension outside the scope in the same directory in which they are stored...

CVE-2020-12103

Tiny File Manager 2.4.1 contains a vulnerability in the ajax file backup copy functionality that allows authenticated users to create backup copies (.bak) outside the intended scope in the same directory. The issue is due to a flaw in the backup copy feature. Remediation suggested in the connecte...

gvfs: mishandling of file ownership in daemon/gvfsbackendadmin.c

It was discovered that gvfs incorrectly set the ownership of files handled by the admin:// backend. An attacker could abuse this flaw when the destination file of a copy/move operation is handled by the admin:// backend. The attacker would have access to the target files with the ability to read...

gvfs: mishandling of file's user and group ownership in daemon/gvfsbackendadmin.c due to unavailability of root privileges

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move and copy with GFILECOPYALLMETADATA operations from admin:// to file:// URIs, because root privileges are unavailable...