DEBIAN-CVE-2020-15396

In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root...

phpList cross-site scripting vulnerability (CNVD-2020-38221)

phpList is an open source newsletter and email marketing software from phpList UK. A cross-site scripting vulnerability exists in the /lists/admin/user.php and /lists/admin/users.php files in versions of phpList prior to 3.5.4. The vulnerability stems from a lack of proper validation of client-si...

Citrix Systems Citrix ShareFile storage zones Controller path traversal vulnerability (CNVD-2020-41790)

Citrix Systems Citrix ShareFile is a file sharing solution from Citrix Systems. storage zones Controller is one of the storage zone controllers. A path traversal vulnerability exists in Citrix Systems Citrix ShareFile storage zones Controller. An attacker can exploit this vulnerability to access...

Linux: SSH StrictModes

StrictModes: Specifies whether sshd should check file modes and ownership of the user SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2020-11443

The Zoom IT installer for Windows ZoomInstallerFull.msi prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing an updated version of the client. Standard users are able to write to this directory, and can write links to other directories on the machine. As the installer...

Information Disclosure

Pluggable Authentication Modules PAM is vulnerable to Information Disclosure. It was discovered that the pammail module used root privileges while accessing users' files. In certain configurations, a local, unprivileged user could use this flaw to obtain limited information about files or...

h1-ctf: [h1-415 2020] Multiple vulnerabilities leading to leaking of secret user files

Hello, I'm just submitting both flags for CTF, will send my write up on hacker summary, since it's 7:00 am now :. Original flag for CTF: h1ctfy3s1mc0sm1cn0w Extra flag for unintended account takeover: h1ctfwtf1shapp3ningw1thth1ss1mulat1on Sincerely, @nukedx Impact By chaining multiple...

Linux: Separate partition for /home

The /home directory contains local files for user. This script tests if a separate partition exists for /home. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU...

CVE-2019-12150

Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document neither file types nor extensions are restricted. The attacker must use the Attach icon to perform an upload. An uploaded file is accessible under the UltimateEditorInclude/UserFiles/ URI...

Schneider Electric Modbus Serial Driver Resource Management Error Vulnerability

Schneider Electric Modbus Serial Driver is a serial driver from Schneider Electric France. A resource management error vulnerability exists in the Schneider Electric Modbus Serial Driver. An attacker could exploit this vulnerability to perform write operations to system files or other critical us...

Arbitrary File Download Vulnerability in HAND SRM Cloud Platform

HAND SRM Cloud Platform is a one-stop digital management platform based on SaaS service/technology architecture. HAND SRM Cloud Platform suffers from an arbitrary file download vulnerability that can be exploited by attackers to download files uploaded by other users...

CVE-2019-10632

A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...

USN-3784-1 AppArmor update

As a security improvement, this update adjusts the private-files abstraction to disallow writing to thumbnailer configuration files. Additionally adjust the private-files, private-files-strict and user-files abstractions to disallow writes on parent directories of sensitive files...

PT-2018-19245

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description This issue involves adjusting the private-files abstraction to disallow writing to thumbnailer configuration files. Additionally, the private-files,...

BaserCMS Access Privilege Bypass Vulnerability

baserCMS is an enterprise-level content management system CMS. A privilege bypass vulnerability exists in baserCMS versions 4.1.0.1 and earlier and 3.0.15 and earlier, which stems from the program failing to restrict access. A remote attacker can exploit this vulnerability to bypass access...

Shopify: Replace other user files in Inbox messages

Summary When a store publishes their listing, a user can message them if they are interested. Company can reply to this query and also add a file. When a file is uploaded, the link looks like this: https://shopify-exchange-private.s3.amazonaws.com/attachments/. This file can be replaced if the...

CVE-2017-15131

It was found that the system umask policy is not being honored when creating XDG user directories /Desktop etc on first login. This could lead to user's files being inadvertently exposed to other local users...

Afian AB FileRun 2017.03.18 CSRF / Shell Upload / XSS / Redirection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact: critical homepage: https://www.filerun.com |...

Directory Traversal Vulnerability in Smart Audi App for Android

Smart Audi APP is a car service software for Audi owner users, providing vehicle physical examination, search navigation, fuel consumption statistics and other services. Wisdom Audi APP Android version has a directory traversal vulnerability, attackers can use the vulnerability to directly downlo...

Multiple Open Redirect Vulnerabilities

Moodle is vulnerable to multiple open redirect vulnerabilities. The vulnerabilities exist because of insufficient filtering of return URLs on some pages, leading to redirection to other arbitrary sites. It can also result in phishing attacks through 1 backup/backupfilesedit.php, 2...