CVE-2020-3503

A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration or system files. The vulnerability is due to insufficient file system permissions on an affected device. An attacker could...

CVE-2020-3477

A vulnerability in the CLI parser of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to access files from the flash: filesystem. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker...

PT-2020-4429 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the file system permissions of Cisco IOS XE Software could allow an authenticated, local attacker to obtain read and write access to critical configuration ...

About the security content of macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave

About the security content of macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave This document describes the security content of macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave. About Apple security updates F...

CVE-2019-15963

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive information in the web-based management interface of the affected software. The vulnerability is due to insufficient protection of...

Exploiting Oracle WebLogic by Remote Code Execution with a /console endpoint restricted

This article explains how to exploit Oracle WebLogic for remote code execution by using valid credentials. Its useful during black-box security audits, pentests, and infrastructure audits, including automated vulnerability scanning. To set up an example playground, we will use the following docke...

CVE-2020-24333

A vulnerability in Arista’s CloudVision Portal CVP prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing a specific API...

bash: BASH_CMD is writable in restricted bash shells

rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASHCMDS, thus allowing the user to execute any command with the permissions of the shell...

The vulnerability of the CAMS for HIS distributed control systems’ emergency message and event management components allows attackers to create or re-record arbitrary files and execute arbitrary commands through unspecified vectors.

The vulnerability of the CAMS for HIS distributed control systems’ emergency message and event management component is related to deficiencies in checking the path name to the restricted-access catalog. Exploiting this vulnerability could allow an attacker to create or re-record arbitrary files a...

VyOS restricted-shell Escape / Privilege Escalation Exploit

This Metasploit module exploits command injection vulnerabilities and an insecure default sudo configuration on VyOS versions 1.0.0 through 1.1.8 to execute arbitrary system commands as root. VyOS features a restricted-shell system shell intended for use by low privilege users with operator...

CVE-2020-24046

A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. This restricted shell can be bypassed after changing the properties of the user admin in the operating...

CVE-2020-24045

A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. The restricted shell can be bypassed by presenting a fake vmware-tools ISO image to the guest virtual...

CVE-2020-24045

A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. The restricted shell can be bypassed by presenting a fake vmware-tools ISO image to the guest virtual...

CVE-2020-24045

CVE-2020-24045 affects TitanHQ SpamTitan Gateway 7.07. The vulnerability arises from a sandbox escape in the restricted admin shell: when a fake VMware Tools ISO image is mounted in the guest VM, and the hidden VMware Tools install path vmware-freebsd-tools/vmware-tools-distrib/vmware-install.pl ...

Path traversal

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Transversal' vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which allows an attacker to place content in any unprotected folder on the target system using a crafted .RCZ file...

CVE-2020-7268

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

CVE-2020-7268 McAfee Email Gateway (MEG) - Path Traversal vulnerability

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

IBM Spectrum Protect Plus Path Traversal Vulnerability (CNVD-2020-52457)

IBM Spectrum Protect formerly known as Tivoli Storage Manager and IBM Spectrum Protect Plus are both products of IBM Corporation, U.S.A. IBM Spectrum Protect is a data protection platform. IBM Spectrum Protect is a data protection platform that provides organizations with a single point of contro...

IBM Spectrum Protect Plus Path Traversal Vulnerability (CNVD-2020-52458)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Plus suffers from a pa...

SAP Marketing Improper Access Control Vulnerability

SAP Marketing is a suite of marketing solutions for SAP. An improper access control vulnerability exists in SAP Marketing Servlet versions 130, 140, and 150. An authenticated attacker could exploit this vulnerability to invoke certain restricted functions and perform tasks related to interactive...