CVE-2020-26273 sqlite ATTACH allows some filesystem access

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb, someone with administrative access to osquery can cause reads and writes to arbitrary sqlite databases on disk. This does allow arbitrary...

Linux kernel path traversal vulnerability (CNVD-2021-09808)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A path traversal vulnerability exists in versions of Linux kernel prior to 5.6, which stems from its failure to safely handle the root directory during path lookups, so that...

Kubernetes: Kubelet follows symlinks as root in /var/log from the /logs server endpoint

Summary: Privilege escalation from a pod, to root read permissions on the entire filesytem of the node, by creating symlinks inside /var/log. The kubelet is simply serving a fileserver at /var/log: kubernetes\pkg\kubelet\kubelet.go:1371 golang if kl.logServer == nil kl.logServer =...

CVE-2020-27403

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 tha...

Information disclosure

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 tha...

CVE-2020-27403

A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 tha...

CVE-2020-9771

This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A user may gain access to protected parts of the file system...

CVE-2020-15230

Vapor (Swift) vulnerable before 4.29.4 when using FileMiddleware: attackers can read arbitrary files on the same host via path traversal/percent-encoded relative paths, leading to data disclosure. Impact is data exposure with HIGH confidentiality impact per CVSS in sources. Fixed in Vapor 4.29.4;...

CloudBees Jenkins ElasTest Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

[ASA-202009-2] ark: arbitrary filesystem access

Arch Linux Security Advisory ASA-202009-2 ========================================= Severity: High Date : 2020-09-03 CVE-ID : CVE-2020-24654 Package : ark Type : arbitrary filesystem access Remote : No Link : https://security.archlinux.org/AVG-1216 Summary ======= The package ark before version...

Directory Traversal in welcomyzt

welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing ../ in the url. Example request: http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host: localhost and server Response: http HTTP/1.1 200 OK...

GHSA-8FV7-VM2P-5495 Directory Traversal in welcomyzt

welcomyzt is a simple file server. welcomyzt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing ../ in the url. Example request: http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host: localhost and server Response: http HTTP/1.1 200 OK...

GHSA-2F29-PMPX-VJ62 Directory Traversal in serverwg

serverwg is a simple http server. serverwg is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL. Example request: http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:foo and response: HTTP/1.1 200 OK Date: Wed, 17 May...

Directory Traversal in xtalk

Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL. Example request: http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:localhost Recommendation No patch is currently available for this vulnerability, and t...

GHSA-CQV6-7FWC-8M3C Directory Traversal in xtalk

Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL. Example request: http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:localhost Recommendation No patch is currently available for this vulnerability, and t...

CVE-2020-3520

A vulnerability in Cisco Data Center Network Manager DCNM Software could allow an authenticated, local attacker to obtain confidential information from an affected device. The vulnerability is due to insufficient protection of confidential information on an affected device. An attacker at any...

CVE-2020-14316

A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances VMIs can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any...

Design/Logic Flaw

A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances VMIs can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any...

CVE-2020-14316

A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances VMIs can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any...

CVE-2020-14316

CVE-2020-14316 – mode C Affected software: kubevirt (VMIs) prior to 0.29.0. Root cause: insufficient isolation controls between VMIs and host, enabling a VM process to access the host filesystem. Impact: attacker can gain the privileges of the VM on the host, potentially reading and modifying any...