PT-2019-1720

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 8800 Series versions prior to 11.05 for Wireless IP Phone 8821 and 8821-EX Cisco IP Phone 8800 Series versions prior to 12.51SR1 for the IP Conference Phone 8832 and the rest of the IP Phone 8800 Series Description A vulnerabili...

PT-2019-14754

Name of the Vulnerable Software and Affected Versions Cisco HyperFlex software versions prior to 3.52a Description The issue is related to insufficient authorization controls in the Graphite interface, allowing an authenticated, local attacker to write arbitrary data. This can be exploited by...

CVE-2019-1667: Insufficient Verification of Data Authenticity

A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the...

Cisco HyperFlex Authorization Control Vulnerability

Cisco HyperFlex Software is a scalable, distributed file system. Cisco HyperFlex has an authorization control vulnerability in the Graphite interface, which can be exploited by a local attacker to write arbitrary data to Graphite and display invalid statistics in that interface by connecting to t...

Authorization Bypass

Linux kernel-rt is vulnerable to authorization bypass. The default SCSI command filter block/scsiioctl.c does not accommodate commands that overlap across device classes, allowing local users to bypass intended access restrictions to write arbitrary data to a read-only LUN via an SGIO ioctl call...

PT-2018-14307

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue allows a local attacker to traverse directories on the system by exploiting a "Zip-Slip" vulnerability. This can be achieved by persuading a victim to extract a...

CVE-2018-19124

PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files...

CVE-2018-5059

Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user...

Directory traversal

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...

CVE-2018-1000544

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...

CVE-2018-1000544

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...

CVE-2018-1000544: Improper Link Resolution Before File Access

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...

PT-2018-9363

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.121 Jenkins LTS versions prior to 2.107.3 Description A path traversal issue exists that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing security protections. This is due t...

dbman service of the Code Execution

The vulnerability of the dbman service of the HPE Intelligent Management Center PLAT software platform is related to the improper processing of the Opcode 10010 request. Exploiting this vulnerability allows a remote attacker to write arbitrary files and execute arbitrary code...

CVE-2014-3219

fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on 1 /tmp/fishd.log.%s, 2 /tmp/.pac-cache.$USER, 3 /tmp/.yum-cache.$USER, or 4 /tmp/.rpm-cache.$USER...

CVE-2014-5003

chef/travis-cookbooks/cienvironment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer...

CVE-2017-15894

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager DSM 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

PT-2017-14271

Name of the Vulnerable Software and Affected Versions Synology File Station versions prior to 1.1.1-0099 Description The issue allows remote authenticated users to write arbitrary files via the dest folder path parameter in the SYNO.FileStation.Extract function. Recommendations For versions prior...

CVE-2017-15894: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager DSM 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...

CVE-2017-15893: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitrary files via the destfolderpath parameter...