6681 matches found
PT-2021-17743 · Netflix · Netflix Oss Hollow
Name of the Vulnerable Software and Affected Versions: Netflix OSS Hollow affected versions not specified Description: The issue allows an attacker to pre-create directories with wide permissions since the Files.existsparent check is performed before creating the directories. Furthermore, the use...
react-dev-utils OS Command Injection in function `getProcessForPort`
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...
GNOME Glib 后置链接漏洞
GNOME Glib is a multi-platform toolkit for creating graphical user interfaces and is the underlying core library for GTK+ and GNOME projects. A security vulnerability exists in GNOME GLib before 2.66.8, which stems from the fact that gfilereplace and GFILECREATEREPLACEDESTINATION incorrectly also...
Command injection
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...
Directory traversal
An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files such as an executable file under the web root. This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x...
Command Injection in facebook/create-react-app
description react-dev-utils includes some utilities used by Create React App. The function getProcessForPort in react-dev-utils is vulnerable to command injection. PoC Create a .js file with the content below and run it, then the file pzhou@shu can be illegally created. var getProcessForPort =...
@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2021-21310 via next-auth (3.1.0)
next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2021-21310 Source advisory: OSV:GHSA-PG53-56CG-4M8Q...
CVE-2020-26195
Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A remote unauthenticated attacker may take advantage of this issue to slow down the system...
CVE-2020-26195
Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A remote unauthenticated attacker may take advantage of this issue to slow down the system...
CVE-2020-26195
Dell EMC PowerScale OneFS (versions 8.1.2–9.1.0) is affected by an issue where the SMB directory auto-create feature may erroneously create a directory for a user, potentially enabling a remote unauthenticated actor to slow down the system. The vulnerability details are corroborated across multip...
CVE-2020-26195
Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directory for a user. A remote unauthenticated attacker may take advantage of this issue to slow down the system...
PT-2021-11223 · Dell Emc · Dell Emc Powerscale Onefs
Name of the Vulnerable Software and Affected Versions: Dell EMC PowerScale OneFS versions 8.1.2 through 9.1.0 Description: The issue in Dell EMC PowerScale OneFS allows a remote unauthenticated attacker to potentially slow down the system by exploiting the OneFS SMB directory auto-create feature,...
7: OpenWire can create destinations with an unpriviledged user
A flaw was found in AMQ 7 broker, where it allows users using the OpenWire protocol to bypass the usual permissions checks. This flaw allows an unprivileged user to create queues without verifying the role. The highest threat from this vulnerability is to integrity...
kernel: Nfsd failure to clear umask after processing an open or create
A flaw incorrect umask during file or directory modification in the Linux kernel NFS network file system functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with...
kernel: Nfsd failure to clear umask after processing an open or create
A flaw incorrect umask during file or directory modification in the Linux kernel NFS network file system functionality was found in the way user create and delete object using NFSv4.2 or newer if both simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with...
CentOS 8 : postgresql:12 (CESA-2020:5620)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:5620 advisory. - postgresql: Uncontrolled search path element in logical replication CVE-2020-14349 - postgresql: Uncontrolled search path element in CREATE EXTENSION...
FetLife: Stored XSS via `Create a Fetish` section.
The reporter pointed out that the fetish field for creating new fetishes on FetLife was vulnerable to a stored XSS exploit, after creating a fetish for which this exploit was used the contents would execute whenever people added the fetish to their profile and attempted to edit the fetish through...
CVE-2021-2045
Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle...
CVE-2021-1993
Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Java VM...