Apple Shortcuts for iOS Input Validation Error Vulnerability

Apple Shortcuts for iOS is a set of shortcut applications from Apple USA based on the iOS platform. A security vulnerability exists in the handling of directory paths in versions of Apple Shortcuts for iOS prior to 2.1.3. A local attacker can exploit the vulnerability to view sensitive user...

CVE-2019-6019

STAMP Workbench installer is affected by an insecure DLL search path (CWE-427) in the Windows installer, enabling arbitrary code execution with the user’s privileges via a Trojan horse DLL loaded from an unspecified directory. The issue is specific to the installer component, not the STAMP Workbe...

CVE-2019-18955

The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...

Remote code execution

Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious binary by an attacker within the parent path could allow code execution...

ABB PB610 Panel Builder 600 PB610 HMISimulator Unauthorized Access Vulnerability

ABB PB610 Panel Builder 600 is a software from ABB Switzerland for designing graphical user interfaces for the CP600 control panel platform.PB610 HMISimulator is one of the PB610 emulator components. A security vulnerability exists in the path configuration of PB610 HMISimulator 2.8.0.424 and...

Design/Logic Flaw

IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search path vulnerability. By using a executable file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM...

Design/Logic Flaw

An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized but non-privileged local user to execute arbitrary code with elevated system privileges. QNAP have already fixed this issue in QNAP NetBak...

DEBIAN-CVE-2010-3359

If LDLIBRARYPATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account...

python: CRLF injection via the path part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the path component of a URL that...

WordPress ThemeMakers SmartIT Premium Responsive theme Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ThemeMakers SmartIT Premium Responsive theme is a responsive website theme plugin used in it. A security vulnerability exists in...

Updated samba packages fix security vulnerabilities

Updated samba packages fix security vulnerabilities: A combination of parameters and permissions in smb.conf can allow user to escape from the share path definition CVE-2019-10197. An authenticated user can crash the Samba AD DC's RPC server process via a NULL pointer dereference CVE-2019-12435 A...

Lenovo Yoga 700-11ISK and Yoga 700-14ISK DLL Search Path Vulnerability

The Lenovo Yoga 700-11ISK and Yoga 700-14ISK are both laptops from the Chinese company Lenovo Lenovo. The Lenovo Yoga 700-11ISK and Yoga 700-14ISK suffer from a DLL search path vulnerability that can be exploited by an attacker to elevate privileges...

UBUNTU-CVE-2018-18838

An issue was discovered in Netdata 1.10.0. Log Injection or Log Forgery exists via a %0a sequence in the url parameter to api/v1/registry...

@codedungeon/gunner (>=0.0.1 <=0.80.1), @codedungeon/laravel-versions-cli (>=0.0.3 <=0.1.0) +74 more potentially affected by unknown CVE via fs-path (>=0.0.22 <=0.0.24)

fs-path NPM version =0.0.22, =0.0.1, =0.0.3, =0.0.9, =1.0.2, =1.0.1, =0.0.1, =1.0.0, =1.0.0, =0.0.40, =1.0.1, =0.0.1, =1.0.1, =0.1.0, =1.0.0, =1.0.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-GC94-6W89-HPQR...

GHSA-GC94-6W89-HPQR Command Injection in fs-path

All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available...

Command Injection in fs-path

All versions of fs-path are vulnerable to command injection is unsanitized user input is passed in. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available...

curl: Windows Privilege Escalation: Malicious OpenSSL Engine

Summary: The curl windows binaries are built with OpenSSL libraries and have an insecure path for the OPENSSLDIR build parameter. This path is set to c:\usr\local\ssl. When curl is executed it attempts to load openssl.cnf from this path. By default on windows, low privileged users have the...

CVE-2019-5958

CVE-2019-5958 affects Electronic reception and examination of application for radio licenses Offline (version 1.0.9.0 and earlier). The root cause is an untrusted DLL search path that may allow loading of a Trojan DLL, enabling arbitrary code execution with the privileges of the running process (...

CVE-2019-5957

CVE-2019-5957 is an untrusted search path vulnerability in the installer for the Electronic reception and examination of application for radio licenses Online (versions 1.0.9.0 and earlier). The issue allows an attacker to execute arbitrary code by Trojan-horse DLLs loaded from an insecure DLL se...

CVE-2019-6154

CVE-2019-6154 describes a DLL search path vulnerability in Lenovo Bootable Generator (prior to Mar-2019) that could allow a local attacker to execute code. Affected software: Lenovo Bootable Generator (used to create Linux diagnostics on bootable USB). Root cause: DLL search path flaw. Impact: lo...