Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path...

Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path...

SUSE CVE-2023-41914

SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files...

Default credentials

The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to overwrite arbitrary files...

Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS 17 and iPadOS 17, which arises from an application that may be able to...

PT-2023-5467

Name of the Vulnerable Software and Affected Versions Ansible affected versions not specified Description A path traversal issue exists when Ansible extracts tarballs, allowing an attacker to craft a malicious tarball. This could result in a symlink being dropped on the disk when using the galaxy...

SUSE CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

Code injection

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

croc path traversal vulnerability

croc is a tool from the individual developers at Zack that allows any two computers to simply and securely transfer files and folders. A path traversal vulnerability exists in Croc version 9.6.5 and prior versions, which originates from a sender that can cause the receiver to overwrite files duri...

Sql injection

A SQL injection in the flutterdownloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. The internal database of the framework is exposed to the local user if an app uses UIFileSharingEnabled and...

PT-2023-27938 · Unknown · Flutter Downloader

Name of the Vulnerable Software and Affected Versions: flutter downloader versions 1.11.1 and earlier Description: A SQL injection in the flutter downloader component allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. The internal database of...

Debian dla-3562 : orthanc - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3562 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3562-1 [email protected] https://www.debian.org/lts/security/...

The vulnerability of the software-based remote monitoring system Advantech WebAccess allows a intruder to gain access to the file system, re-write files, and execute commands.

The vulnerability of the software-based remote monitoring system Advantech WebAccess relates to the use of an untrusted pointer. Exploiting this vulnerability could allow a malicious actor to gain access to the file system, potentially enabling them to overwrite files and execute commands...

Oracle Linux 8 : openssh (ELSA-2019-3702)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3702 advisory. 8.0p1-3 + 0.10.3-7 - Fix typos in manual pages 1668325 - Use the upstream support for PKCS8 PEM files alongside with the legacy PEM files 1712436 -...

CVE-2023-3252

An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition...

CVE-2023-20115

A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode could allow an authenticated, remote attacker to download or overwrite files from the underlying operating system of an affected device. This vulnerability is d...

CVE-2023-20229

A vulnerability in the CryptoService function of Cisco Duo Device Health Application for Windows could allow an authenticated, local attacker with low privileges to conduct directory traversal attacks and overwrite arbitrary files on an affected system. This vulnerability is due to insufficient...