Command Execution Vulnerability in 162100 Website Navigation 3

162100 url navigation 3 is a website source code of url navigation category developed by php+MySQL. 162100 url navigation 3 has a command execution vulnerability. An attacker can exploit the vulnerability to write to a php file, resulting in command execution...

Nagios XI Command Injection Vulnerability (CNVD-2020-58771)

Nagios XI and Nagios are both products of Nagios, Inc.Nagios XI is an IT infrastructure monitoring solution. The solution supports monitoring and alerting of applications, services, operating systems, etc. Nagios is an open source, free network monitoring tool. A security vulnerability exists in...

USN-4588-1 flightgear vulnerability

It was discovered that FlightGear could write arbitrary files if received a special nasal script. A remote attacker could exploit this with a crafted file to execute arbitrary code...

File upload vulnerability in TWCMS backend se***_co***.cl***.php file

TWCMS Tong Wang CMS is an enterprise website CMS system. A file upload vulnerability exists in the seco.cl.php file in the background of TWCMS. An attacker can exploit the vulnerability to write arbitrary files and gain server privileges...

GHSA-HWV5-W8GM-FQ9F Directory Traversal vulnerability in GET/PUT allows attackers to Disclose Information or Write Files via a crafted GET/PUT request

Impact Information Disclosure When the GET method is attacked, attackers can read files which have a .data suffix and which are accompanied by a JSON file with the .meta suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or...

Directory Traversal vulnerability in GET/PUT allows attackers to Disclose Information or Write Files via a crafted GET/PUT request

Impact Information Disclosure When the GET method is attacked, attackers can read files which have a .data suffix and which are accompanied by a JSON file with the .meta suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or...

CVE-2020-21526

An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it...

CVE-2020-15731

An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448...

Ozeki NG SMS Gateway Path Traversal Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A path traversal vulnerability exists in the "Script Name" of the "Autoresponder" module in Ozeki NG SMS Gateway 4.17.6 and earlier. The vulnerability can be exploited to write or overwrite arbitrary files with...

CVE-2020-14028

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. By leveraging a path traversal vulnerability in the Autoreply module's Script Name, an attacker may write to or overwrite arbitrary files, with arbitrary content, usually with NT AUTHORITY\SYSTEM privileges...

USN-4518-1 xawtv vulnerability

Matthias Gerstner discovered that xawtv incorrectly handled opening files. A local attacker could possibly use this issue to open and write to arbitrary files and escalate privileges. CVE-2020-13696...

Microsoft Spooler Local Privilege Elevation Exploit

This exploit leverages a file write vulnerability in the print spooler service which will restart if stopped. Because the service cannot be stopped long enough to remove the dll, there is no way to remove the dll once it is loaded by the service. Essentially, on default settings, this module adds...

Microsoft Spooler Local Privilege Elevation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Spooler Local Privilege Elevation Vulnerability', 'Description' = %q This exploit leverages a file write vulnerability in the print...

CVE-2020-11977

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

Remote code execution

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

CVE-2020-11977

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

CVE-2020-25289

The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directory which has weak permissions...

CVE-2020-25289

The CVE-2020-25289 entry describes a local file-write vulnerability in the Avast SecureLine VPN service (pre-5.6.4982.470). The issue arises from an Object Manager symbolic link in the log directory that has weak permissions, allowing local users to write to arbitrary files. Some sources corrobor...

Hyland OnBase Directory Traversal Vulnerability (CNVD-2020-51794)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability to write to a file via the FileName parameter...

macOS cfprefsd Arbitrary File Write / Local Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'macOS cfprefsd Arbitrary File Write Local Privilege Escalation', 'Description' = %q This module exploits an arbitrary file write in cfprefsd on...