curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

...

VMware Carbon Black Cloud macOS Sensor installer updates address file overwrite issue (CVE-2020-4008)

3. VMware Carbon Black Cloud macOS Sensor installer file overwrite issue CVE-2020-4008 The installer of the macOS Sensor for VMware Carbon Black Cloud handles certain files in an insecure way. VMware has evaluated the severity of this issue to be in the Low severity range with a CVSSv3 base score...

ALPINE-CVE-2020-8177

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used...

CVE-2020-8177

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used...

CVE-2020-8177

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used...

CVE-2020-8177

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used...

CVE-2020-8177

CVE-2020-8177 affects curl up to 7.70.0, where -J/--remote-header-name combined with -i/--include could allow a malicious server to overwrite a local file due to improper restriction of file names. Connected advisories confirm this vulnerability across distributions (Debian, CentOS, Alpine, Amazo...

NewStart CGSL CORE 5.04 / MAIN 5.04 : libqb Vulnerability (NS-SA-2020-0057)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libqb packages installed that are affected by a vulnerability: - libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames under /dev/shm and /tmp without...

Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 68.11.0 ESR) hava affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF11 + ICAM2019.3.0 - 2020.2.0

Summary Synthetic Playback Agent has addressed the following vulnerabilities: CVE-2020-15649, CVE-2020-15650 Vulnerability Details CVEID: CVE-2020-15649 DESCRIPTION: Mozilla Firefox could allow a remote attacker to bypass security restrictions. By persuading a victim to install a specially crafte...

DEBIAN-CVE-2020-25265

AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by providing a .desktop file that contains Name= with path components...

File Overwrite

libappimage.so is vulnerable to a file overwrite. An attacker can trigger an overwriting a system-installed .desktop file by providing a .desktop file that contains Name= with path components as it does not properly validate the Name field...

PT-2020-8126

Name of the Vulnerable Software and Affected Versions: Crafter Studio version 3.0.1 Description: A directory traversal vulnerability exists in Crafter Studio, allowing unauthenticated attackers to overwrite files from the operating system, which can lead to remote code execution RCE...

Potential file overwrite if archive filename starts with file://

I have submitted this to the PEAR bug tracker as well as the PEAR group mailing list, and I'm not sure if either has gone through, so opening an issue here with the hope that this is the right place for it. While auditing a separate application which uses ArchiveTar internally, I found that...

CVE-2020-28949

ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack such as file:// to overwrite files can still succeed...

CVE-2020-28949

ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack such as file:// to overwrite files can still succeed...

CVE-2020-13355

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: =8.14, =13.4, =13.5, 13.5.2...

Cisco IoT Field Network Director File Overwrite Vulnerability

Cisco IoT Field Network Director FND is a network management system for large-scale FAN deployments. A file overwrite vulnerability exists in Cisco IoT Field Network Director versions prior to 4.6.1. The vulnerability stems from inadequate file system protection. An attacker can exploit the...

Pear Archive_Tar Injection Vulnerability

Pear ArchiveTar is a Php-based software from the Pear PEAR team that can create and extract tarballs. A security vulnerability exists in ArchiveTar version 1.4.10 and earlier versions, which stems from the :// filename sanitization attack only for phar, so any other stream-wrapper file:// to...

Cisco IoT Field Network Director 路径遍历漏洞

Cisco IoT Field Network Director FND is a network management system for large-scale FAN deployments. A file overwrite vulnerability exists in Cisco IoT Field Network Director versions prior to 4.6.1. The vulnerability stems from inadequate file system protection. An attacker can exploit the...

Low: pcp

Issue Overview: A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Modul...