CVE-2019-15027

The MediaTek Embedded Multimedia Card eMMC subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arbitrary commands as root via shell metacharacters in a filename under /data, because clearemmcnomediaentry in platform/mt6577/external/meta/emmc/metaclremmc.c...

cPanel Access Control Error Vulnerability (CNVD-2019-29602)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions of cPanel prior to 68.0.15. An attacker could exploit the vulnerability to delete dat...

CVE-2017-18404

cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD SEC-341...

CVE-2018-20911

cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup SEC-359...

CVE-2019-4430

IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 162887...

PT-2019-17080 · Ibm · Ibm Maximo Asset Management

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management version 7.6 Description: The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL request containing dot dot sequences /../ to view arbitrary files on the system...

The vulnerability of the .NET SDK WebForm Viewer component, a software tool for report development with SAP Crystal Reports for Visual Studio, allows attackers to disclose protected information.

The vulnerability of the .NET SDK WebForm Viewer component, a software tool for report development with SAP Crystal Reports for Visual Studio, is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to disclose sensitive information, includin...

CVE-2019-13464

An issue was discovered in OWASP ModSecurity Core Rule Set CRS 3.0.2. Use of X.Filename instead of XFilename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid...

DEBIAN-CVE-2019-13464

An issue was discovered in OWASP ModSecurity Core Rule Set CRS 3.0.2. Use of X.Filename instead of XFilename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid...

AZL-44598 CVE-2019-13464 affecting package mod_security_crs 3.0.0-11

An issue was discovered in OWASP ModSecurity Core Rule Set CRS 3.0.2. Use of X.Filename instead of XFilename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid...

DEBIAN-CVE-2019-13241

FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in a ZIP archive entry that is mishandled during extraction...

CVE-2019-4252

IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 159883...

Directory traversal

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location dot-dot-slash notation to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java...

Preview of Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 8.1, RT 8.1, and Server 2012 R2 (KB4503867)

Preview of Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 8.1, RT 8.1, and Server 2012 R2 KB4503867 Applies to: Microsoft .NET Framework 3.5, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6.1, Microsof...

Command Injection in dot

All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype...

GHSA-4859-GPC7-4J66 Command Injection in dot

All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype...

Microsoft .NET Framework and .NET Core Denial of Service Vulnerability (CNVD-2020-62336)

Microsoft .NET Core and Microsoft .NET Framework are both products of the U.S.-based Microsoft Corporation Microsoft. NET Core is a free and open source development platform. NET Core is a free, open source development platform that features multi-language support and cross-platform...

A week in security (May 6 – 12)

Last week on Labs, we discussed what to do when you discover a data breach, how 5G could impact cybersecurity strategy, the top six takeaways for user privacy, vulnerabilities in financial mobile apps that put consumers and businesses at risk, and in our series about vital infrastructure, we...

Google Android System typer.cc file out-of-bounds write vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An out-of-bounds write vulnerability exists in the JSCallTyper of the typed.cc file in Android. The vulnerability stems from a networked system or product performing operations in memory without...

Google Android System objects.cc file remote code execution vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. A remote code execution vulnerability exists in the CalculateInstanceSizeForDerivedClass of the objects.cc file in Android. An attacker could exploit the vulnerability to execute code...