205 matches found
Linux: SSH StrictModes
StrictModes: Specifies whether sshd should check file modes and ownership of the user SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
CVE-2020-11443
The Zoom IT installer for Windows ZoomInstallerFull.msi prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version of the client. Standard users are able to write to this directory, and can write links to other directories on the machine. As the installer...
Information Disclosure
Pluggable Authentication Modules PAM is vulnerable to Information Disclosure. It was discovered that the pammail module used root privileges while accessing users' files. In certain configurations, a local, unprivileged user could use this flaw to obtain limited information about files or...
h1-ctf: [h1-415 2020] Multiple vulnerabilities leading to leaking of secret user files
Hello, I'm just submitting both flags for CTF, will send my write up on hacker summary, since it's 7:00 am now :. Original flag for CTF: h1ctfy3s1mc0sm1cn0w Extra flag for unintended account takeover: h1ctfwtf1shapp3ningw1thth1ss1mulat1on Sincerely, @nukedx Impact By chaining multiple...
Linux: Separate partition for /home
The /home directory contains local files for user. This script tests if a separate partition exists for /home. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU...
CVE-2019-12150
Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document neither file types nor extensions are restricted. The attacker must use the Attach icon to perform an upload. An uploaded file is accessible under the UltimateEditorInclude/UserFiles/ URI...
Schneider Electric Modbus Serial Driver Resource Management Error Vulnerability
Schneider Electric Modbus Serial Driver is a serial driver from Schneider Electric France. A resource management error vulnerability exists in the Schneider Electric Modbus Serial Driver. An attacker could exploit this vulnerability to perform write operations to system files or other critical us...
Arbitrary File Download Vulnerability in HAND SRM Cloud Platform
HAND SRM Cloud Platform is a one-stop digital management platform based on SaaS service/technology architecture. HAND SRM Cloud Platform suffers from an arbitrary file download vulnerability that can be exploited by attackers to download files uploaded by other users...
CVE-2019-10632
A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...
USN-3784-1 AppArmor update
As a security improvement, this update adjusts the private-files abstraction to disallow writing to thumbnailer configuration files. Additionally adjust the private-files, private-files-strict and user-files abstractions to disallow writes on parent directories of sensitive files...
BaserCMS Access Privilege Bypass Vulnerability
baserCMS is an enterprise-level content management system CMS. A privilege bypass vulnerability exists in baserCMS versions 4.1.0.1 and earlier and 3.0.15 and earlier, which stems from the program failing to restrict access. A remote attacker can exploit this vulnerability to bypass access...
Shopify: Replace other user files in Inbox messages
Summary When a store publishes their listing, a user can message them if they are interested. Company can reply to this query and also add a file. When a file is uploaded, the link looks like this: https://shopify-exchange-private.s3.amazonaws.com/attachments/. This file can be replaced if the...
CVE-2017-15131
It was found that the system umask policy is not being honored when creating XDG user directories /Desktop etc on first login. This could lead to user's files being inadvertently exposed to other local users...
Afian AB FileRun 2017.03.18 CSRF / Shell Upload / XSS / Redirection
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact: critical homepage: https://www.filerun.com |...
Directory Traversal Vulnerability in Smart Audi App for Android
Smart Audi APP is a car service software for Audi owner users, providing vehicle physical examination, search navigation, fuel consumption statistics and other services. Wisdom Audi APP Android version has a directory traversal vulnerability, attackers can use the vulnerability to directly downlo...
Multiple Open Redirect Vulnerabilities
Moodle is vulnerable to multiple open redirect vulnerabilities. The vulnerabilities exist because of insufficient filtering of return URLs on some pages, leading to redirection to other arbitrary sites. It can also result in phishing attacks through 1 backup/backupfilesedit.php, 2...
UBUNTU-CVE-2017-8921
In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear flightplan XML. A resource such as a malicious third-party aircraft could exploit this to damage files belonging to...
Design/Logic Flaw
Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file...
