Arbitrary File Access

org.xwiki.commons:xwiki-commons-velocity is vulnerable to arbitrary file access. A privileged attacker who has access to an file returning API, is able to perform read or write operations on the filesystem because it is not properly sandboxed against using the Java File API...

PT-2022-16949 · Unknown +1 · Kustomize-Controller +1

Name of the Vulnerable Software and Affected Versions: kustomize-controller versions prior to 0.24.0 flux2 versions prior to 0.29.0 Description: The issue concerns a Path Traversal vulnerability in the kustomize-controller via a malicious kustomization.yaml file, allowing an attacker to expose...

PT-2022-2505 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This issue is due to...

CVE-2022-24897 Arbitrary filesystem write access from Velocity

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem...

CVE-2022-24897

CVE-2022-24897 affects XWiki Commons/Velocity integration. The Velocity scripting feature allowed scripts to access the Java File API, enabling read/write operations on the filesystem when scripts ran with Script rights. Vulnerable versions include 2.3 prior to 12.6.7, 12.10.3, and 13.0. The root...

CVE-2022-24897 Arbitrary filesystem write access from Velocity

APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem...

CVE-2022-29973

relan exFAT 1.3.0 allows local users to obtain sensitive information data from deleted files in the filesystem in certain situations involving offsets beyond ValidDataLength...

Design/Logic Flaw

relan exFAT 1.3.0 allows local users to obtain sensitive information data from deleted files in the filesystem in certain situations involving offsets beyond ValidDataLength...

CVE-2022-29973

relan exFAT 1.3.0 allows local users to obtain sensitive information data from deleted files in the filesystem in certain situations involving offsets beyond ValidDataLength...

CVE-2022-29973

relan exFAT 1.3.0 allows local users to obtain sensitive information data from deleted files in the filesystem in certain situations involving offsets beyond ValidDataLength...

CVE-2022-29973

relan exFAT 1.3.0 allows local users to obtain sensitive information data from deleted files in the filesystem in certain situations involving offsets beyond ValidDataLength...

CVE-2022-29973

CVE-2022-29973 affects relan exFAT 1.3.0. The issue allows local users to obtain sensitive information from data of deleted files in the filesystem in certain situations involving offsets beyond ValidDataLength. The available connected records confirm the affected product/version and the nature o...

GHSA-6M9F-8VWQ-97PM Smarty Does Not Consider Umask Values When Setting Permissions

Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations...

Smarty Does Not Consider Umask Values When Setting Permissions

Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations...

CVE-2022-29973

relan exFAT 1.3.0 allows local users to obtain sensitive information data from deleted files in the filesystem in certain situations involving offsets beyond ValidDataLength...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-019)

The version of kernel installed on the remote host is prior to 5.4.91-41.139. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-019 advisory. A flaw was found in the JFS filesystem code. This flaw allows a local attacker with the ability to set...

Podman publishes a malicious image to public registries

Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman...

GHSA-66VW-V2X9-HW75 Podman publishes a malicious image to public registries

Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman...

CVE-2022-1227

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to...

CVE-2022-1227

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to...