Cisco AnyConnect Secure Mobility Client for Mac OS File Corruption (cisco-sa-anyconnect-mac-dos-36s2y3Lv)

According to its self-reported version, Cisco AnyConnect Secure Mobility Client is affected by a file corruption vulnerability. The vulnerability is due to the incorrect handling of directory paths. An authenticated, attacker could exploit this vulnerability by creating a symbolic link symlink to...

PT-2021-7353 · Apache +6 · Apache Subversion +6

Name of the Vulnerable Software and Affected Versions: Apache Subversion versions prior to the fixed version Description: The issue is related to improper authorization in the centralized version control system Apache Subversion. Exploitation of this issue allows a remote attacker to access...

CVE-2021-28544

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization authz rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom...

VulnCheck KEV: CVE-2018-9205

Vulnerability in avataruploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path...

Directory Traversal

Open Container Initiative umoci is vulnerable to directory traversal. It allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used...

Investigating a unique “form” of email delivery for IcedID malware

Microsoft threat analysts have been tracking activity where contact forms published on websites are abused to deliver malicious links to enterprises using emails with fake legal threats. The emails instruct recipients to click a link to review supposed evidence behind their allegations, but are...

PT-2024-11143 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak issue has been resolved in the Linux kernel, specifically in the crypto: sun8i-ss module. The problem occurs due to several failure return paths that do not free the pad,...

CVE-2021-1386 Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability

A vulnerability in the dynamic link library DLL loading mechanism in Cisco Advanced Malware Protection AMP for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this...

CVE-2021-1386 Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability

A vulnerability in the dynamic link library DLL loading mechanism in Cisco Advanced Malware Protection AMP for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this...

CVE-2021-29136

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used...

CVE-2021-29136

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used...

The vulnerability of server installers for Building Management Systems Enterprise Server and Enterprise Central on Windows operating systems allows a hacker to increase their privileges.

The vulnerability of server installers for Building Management Systems like Enterprise Server and Enterprise Central on Windows operating systems is related to the absence of quotation marks in the wording of search elements or paths. Exploiting this vulnerability can allow attackers to increase...

CVE-2021-27220

An issue was discovered in PRTG Network Monitor before 21.1.66.1623. By invoking the screenshot functionality with prepared context paths, an attacker is able to verify the existence of certain files on the filesystem of the PRTG's Web server...

CVE-2021-27220

An issue was discovered in PRTG Network Monitor before 21.1.66.1623. By invoking the screenshot functionality with prepared context paths, an attacker is able to verify the existence of certain files on the filesystem of the PRTG's Web server...

Zeratool

This is an offensive tool for CTF Capture The Flag problems. It is designed to automatically generate exploits and remotely capture flags for exploitable CTF problems. The tool, called Zeratool, uses the angr binary analysis framework to concolically analyze binaries by hooking printf and looking...

PT-2021-11230 · Go-Ipfs · Go-Ipfs

Name of the Vulnerable Software and Affected Versions: go-ipfs versions prior to 0.8.0-rc1 Description: The issue is related to path traversal in go-ipfs, which can occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten or written to incorrect output...

USN-4820-1: S-nail vulnerability

It was discovered that S-nail incorrectly handled paths. An attacker could possible use this issue to write arbitrary files and escalate privileges...

USN-4770-1 glusterfs vulnerabilities

It was discovered that GlusterFS incorrectly handled network requests. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM. CVE-2014-3619 It was discovered that GlusterFS incorrectly handled user permissions. An authenticated attacker...

Critical Security Bug Can Knock Smart Meters Offline

Critical security vulnerabilities in Schneider Electric smart meters could allow an attacker a path to remote code execution RCE, or to reboot the meter causing a denial-of-service DoS condition on the device. Schneider Electric’s PowerLogic ION/PM smart meter product line, like other smart meter...

Vembu BDR 4.2.0.1 U1 - Multiple Unquoted Service Paths Vulnerability

Exploit Title: Vembu BDR 4.2.0.1 U1 - Multiple Unquoted Service Paths Exploit Author: Mohammed Alshehri Vendor Homepage: https://www.vembu.com/ Software Link: https://sg-build-release.s3.amazonaws.com/BDRSuite/V420/4202020051312/VembuBDRBackupServerSetup4201U1GA.exe Version: Version 4.2.0.1 U1...