Design/Logic Flaw

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Shortcuts 2.1.3 for iOS. A local user may be able to view senstive user information...

CVE-2019-7289

The CVE-2019-7289 issue affects Apple Shortcuts for iOS: a parsing flaw in how directory paths are handled could allow a local user to view sensitive information. The root cause is improper path validation. Remediation is available in Shortcuts 2.1.3 for iOS, which addresses the vulnerability by ...

CVE-2019-7289

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Shortcuts 2.1.3 for iOS. A local user may be able to view senstive user information...

CVE-2019-7289: Improper Limitation of a Pathname to a Restricted Directory

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Shortcuts 2.1.3 for iOS. A local user may be able to view senstive user information...

D-Link DIR-615 Elevation of Privilege Vulnerability

The D-Link DIR-615 is a wireless router from AUO D-Link of Taiwan, China. The D-Link DIR-615 suffers from an elevation of privilege vulnerability that stems from the program's failure to perform complete validation of file paths and error detection. An attacker can exploit the elevation of...

CVE-2019-1477

An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers, aka 'Windows Printer Service Elevation of Privilege Vulnerability'...

CVE-2019-1477: Undefined Security Weakness

An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers, aka 'Windows Printer Service Elevation of Privilege Vulnerability'...

support-core allowed users with Overall/Read permission to delete arbitrary files

support-core did not validate the paths submitted for the "Delete Support Bundles" feature. This allowed users to delete arbitrary files on the Jenkins controller file system accessible to the OS user account running Jenkins. Additionally, this endpoint did not perform a permission check, allowin...

Advantech WISE-PaaS/RMM Path Traversal Vulnerability

Advantech WISE-PaaS/RMM is an IoT device remote monitoring and management platform. A path traversal vulnerability exists in Advantech WISE-PaaS/RMM 3.3.29 and earlier versions. The vulnerability stems from failure to properly validate a user-supplied path before using it for file operations. An...

WADashboard Component File Write

The multiple vulnerabilities of the API interface of the WADashboard component in the Advantech WebAccess remote monitoring software are related to deficiencies in path validation before its use in file operations. Exploiting these vulnerabilities could allow a malicious actor to read arbitrary...

UBUNTU-CVE-2019-17670

WordPress before 5.2.4 has a Server Side Request Forgery SSRF vulnerability because Windows paths are mishandled during certain validation of relative URLs...

PT-2019-4150

Name of the Vulnerable Software and Affected Versions Windows Printer Service affected versions not specified Description The issue is related to an elevation of privilege vulnerability. It occurs due to improper validation of file paths by the Windows Printer Service while loading printer driver...

CentOS 7 : keepalived (CESA-2019:2285)

An update for keepalived is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2019-12326

Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload shell commands within the file and trigger code execution...

Input validation

Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload shell commands within the file and trigger code execution...

CVE-2019-12326

Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone file, with an executable payload shell commands within the file and trigger code execution...

PT-2019-12755

Name of the Vulnerable Software and Affected Versions Akuvox R50P VoIP phone version 50.0.6.156 Description The issue is related to missing file and path validation in the ringtone upload function, allowing an attacker to upload a manipulated ringtone file with an executable payload, such as shel...

Input validation

A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller APIC Software could allow an authenticated, remote attacker to escalate privileges to root on an affected device. The vulnerability is due to incomplete validation and error checki...

CVE-2019-1889 Cisco Application Policy Infrastructure Controller REST API Privilege Escalation Vulnerability

A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller APIC Software could allow an authenticated, remote attacker to escalate privileges to root on an affected device. The vulnerability is due to incomplete validation and error checki...

PT-2019-2651

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller APIC Software versions affected versions not specified Description The issue is related to the implementation of the REST API in the Cisco Application Policy Infrastructure Controller,...