CVE-2023-39479 Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability

Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability. This vulnerability allows remote attackers to create directories on affected installations of Softing Secure Integration Server. Although authentication is required to exploit this vulnerability, the existing...

CVE-2023-39479 Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability

Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability. This vulnerability allows remote attackers to create directories on affected installations of Softing Secure Integration Server. Although authentication is required to exploit this vulnerability, the existing...

CVE-2023-39479

Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability (CVE-2023-39479) affects the OPC UA Gateway handling of FileDirectory OPC UA Objects. The flaw allows remote attackers, bypassing authentication, to create directories by accessing the filesystem, potentially enabli...

kernel: ovl: fix warning in ovl_create_real()

In the Linux kernel, the following vulnerability has been resolved: ovl: fix warning in ovlcreatereal Syzbot triggered the following warning in ovlworkdircreate - ovlcreatereal: if !err && WARNON!newdentry-dinode The reason is that the cgroup2 filesystem returns from mkdir without instantiating t...

BIT-JENKINS-2021-21685

Jenkins LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePathmkdirs...

kernel: Fix of 7 CVEs

KVM: nSVM: avoid picking up unsupported bits from L2 in intctl CVE-2021-3653 CVE-2021-3653 - xen/netfront: fix leaking data in shared pages CVE-2022-33740 - xfs: fix up non-directory creation in SGID directories CVE-2021-4037 - netsched: clsroute: remove from list when handle is 0 CVE-2022-2588 -...

kernel: Fix of 7 CVEs

KVM: nSVM: avoid picking up unsupported bits from L2 in intctl CVE-2021-3653 CVE-2021-3653 - xen/netfront: fix leaking data in shared pages CVE-2022-33740 - xfs: fix up non-directory creation in SGID directories CVE-2021-4037 - netsched: clsroute: remove from list when handle is 0 CVE-2022-2588 -...

MikroTik RouterOS Path Traversal (CVE-2019-3976)

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled. This...

Concrete CMS allows unauthorized access because directories can be created with insecure permissions

Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions such as the Mkdir function gives universal access 0777 to created folders by default. Excessive permissions can be granted when creating...

Design/Logic Flaw

Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions such as the Mkdir function gives universal access 0777 to created folders by default. Excessive permissions can be granted when creating...

PortlandLabs Concrete CMS Security Vulnerability

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. A security vulnerability exists in PortlandLabs Concrete CMS prior to 8.5.13 and versions prior to 9.2.2, which stems from a File creation function that may grant too many permissions when...

CVE-2023-48648

Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions such as the Mkdir function gives universal access 0777 to created folders by default. Excessive permissions can be granted when creating...

PT-2023-30868 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions prior to 8.5.13 Concrete CMS versions 9.x prior to 9.2.2 Description: The issue allows unauthorized access due to directories being created with insecure permissions. File creation functions, such as the Mkdir function,...

CVE-2023-34994

An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to creation of an arbitrary directory. An attacker can send a sequence of...

CVE-2023-34994

Open Automation Software OAS Platform v18.00.0072 contains an improper resource allocation vulnerability in the OAS Engine configuration management functionality. Talos notes that an unauthenticated or low-privileged user can leverage the configuration tool (including a remote file browser that a...

Open Automation Software OAS Platform Security Vulnerability

Open Automation Software OAS Platform is an Industrial Internet of Things IoT suite from US-based Open Automation Software, Inc. It is designed to help organizations connect data sources to the OAS Platform. A security vulnerability exists in Open Automation Software OAS Platform version...

PT-2023-25084 · Open Automation · Open Automation Software Oas Platform

Name of the Vulnerable Software and Affected Versions: Open Automation Software OAS Platform version 18.00.0072 Description: An improper resource allocation issue exists in the OAS Engine configuration management functionality. A specially crafted series of network requests can lead to the creati...

Open Automation Software OAS Platform OAS Engine configuration management improper resource allocation vulnerability

Talos Vulnerability Report TALOS-2023-1773 Open Automation Software OAS Platform OAS Engine configuration management improper resource allocation vulnerability September 5, 2023 CVE Number CVE-2023-34994 SUMMARY An improper resource allocation vulnerability exists in the OAS Engine configuration...

CVE-2023-32003

fs.mkdtemp and fs.mkdtempSync can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp API and the impact is a malicious actor could create an arbitrary directory. This vulnerability affects all users using the...

CVE-2023-32003

CVE-2023-32003 is described in the connected F5 advisory as a path-traversal flaw in Node.js 20's experimental permission model, where fs.mkdtemp() and fs.mkdtempSync() lack a necessary permission-check, allowing a malicious actor to create an arbitrary directory. The impact is limited to users e...