Node.js third-party modules: Filesystem Writes via `yarn install` via symlinks and tar transforms inside a crafted malicious package

I would like to report an arbitrary filesystem write vulnerability in Yarn when installing a malicious package from the default repositories. This vulnerability has the potential for RCE -- even if --ignore-scripts is disabled. It allows a malicious package, upon install, to write to any path on...

CVE-2019-15024

Аn attacker that has write access to ZooKeeper and who can run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When another replica will fetch data part from the...

PT-2017-13011

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection versions prior to 12.1 RU6 MP9 Description The issue is a privilege escalation vulnerability, which allows a user to gain elevated access to resources normally protected at lower access levels. The capability of...

HPESB3P03767 rev.1 - HPE Proliant ML10 Gen9 servers using Intel Xeon E3-1200M v5 and 6th Generation Intel Core Processors, Unauthorized Write to Filesystem

Potential Security Impact: Local: Unauthorized Write Access to the File System; Remote: Unauthorized Write Access to the File System SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant ML10 Gen9 E3-1225 v5 3.3GHz 4-core 8GB-R 1TB Non-hot Plug 4LFF SATA 300W AP Svr/Promo S...