PT-2020-18718

Name of the Vulnerable Software and Affected Versions TP-Link Archer C9US version V1 180125 Description The issue allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the route...

Cisco SD-WAN vManage XML External Entity Injection Vulnerability

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. An XML external entity injection vulnerability exists in the web UI of Cisco SD-WAN vManage 20.1.12 and earlier. The vulnerability stems from improper handling of XML External Entity XXE...

Directory Traversal

openapi-python-client is vulnerable to directory traversal. An attacker is able to write files on arbitrary locations on disk by generating a client with a malicious OpenAPI document...

Path traversal

HUAWEI Mate 20 versions earlier than 10.1.0.160C00E160R3P8, HUAWEI Mate 20 X versions earlier than 10.1.0.135C00E135R2P8, HUAWEI Mate 20 RS versions earlier than 10.1.0.160C786E160R3P8, and Honor Magic2 smartphones versions earlier than 10.1.0.160C00E160R2P11 have a path traversal vulnerability...

CVE-2020-9252: Improper Limitation of a Pathname to a Restricted Directory

HUAWEI Mate 20 versions earlier than 10.1.0.160C00E160R3P8, HUAWEI Mate 20 X versions earlier than 10.1.0.135C00E135R2P8, HUAWEI Mate 20 RS versions earlier than 10.1.0.160C786E160R3P8, and Honor Magic2 smartphones versions earlier than 10.1.0.160C00E160R2P11 have a path traversal vulnerability...

PT-2020-3127

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software affected versions not specified Description The issue is related to the improper restriction of XML external entity references in the web interface of Cisco SD-WAN vManage Software. This could allow a remote...

CVE-2020-15577: Undefined Security Weakness

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 software. Cameralyzer allows attackers to write files to the SD card. The Samsung ID is SVE-2020-16830 July 2020...

CVE-2020-9411

The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This...

Microsoft Releases Security Update for Edge

Microsoft has released a security update to address a vulnerability in Edge Chromium-based. A remote attacker could exploit this vulnerability to write files to arbitrary locations and gain elevated privileges. The Cybersecurity and Infrastructure Security Agency CISA encourages users and...

PT-2020-15224

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS Panorama versions 7.1 Palo Alto Networks PAN-OS Panorama versions 8.0 through 8.0.20 Palo Alto Networks PAN-OS Panorama versions 8.1 through 8.1.11 Palo Alto Networks PAN-OS Panorama versions 9.0 through 9.0.5...

Path traversal

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTPs server and then write files to the user's system anywhere that the user has permissions...

CVE-2020-10696

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTPs server and then write files to the user's system anywhere that the user has permissions...

PT-2020-2769

Name of the Vulnerable Software and Affected Versions Buildah versions prior to 1.14.5 Description A path traversal flaw was found in Buildah. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTPs server and then write files to the user's system...

PT-2020-18529

Name of the Vulnerable Software and Affected Versions Shihonkanri Plus GOOUT versions 1.5.8 through 2.2.10 Description A directory traversal issue allows remote attackers to read and write arbitrary files. Recommendations For versions 1.5.8 through 2.2.10, at the moment, there is no information...

Cisco FXOS Software Input Validation Error Vulnerability

Cisco FXOS Software is a set of firewall software from Cisco that runs in Cisco security appliances. An input validation error vulnerability exists in the CLI in Cisco FXOS Software, which arises from the program failing to perform sufficient input validation. A local attacker could exploit this...

CVE-2020-3166

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating system OS. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted...

PT-2020-18326

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 7.6 Opencast versions prior to 8.1 Description The issue allows almost arbitrary identifiers for media packages and elements to be used, which can be problematic for operation and security. This is because such...

Apache Syncope XSLT Code Execution

The vulnerability of the XSLT Extensible Stylesheet Language Transformations implementation of the Apache Syncope system’s digital identifier management mechanism is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to read files, write files, or...

Cisco Data Center Network Manager REST API Path Traversal Vulnerability

Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. A REST API path traversal vulnerability exists in Cisco Data Center Network Manage...

CVE-2019-19141

The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods, such as on a default Ubuntu installation...