PT-2020-11239

Name of the Vulnerable Software and Affected Versions AMD OverDrive affected versions not specified Description An issue was discovered in AODDriver2.sys, where the vulnerable driver exposes a wrmsr instruction via IOCTL "0x81112ee0" and does not properly filter the Model Specific Register MSR...

PT-2020-11238

Name of the Vulnerable Software and Affected Versions AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility version 5.11.9.0 Description An issue was discovered in the atillk64.sys driver, which exposes a wrmsr instruction and does not properly filter the Model Specific Register MSR...

Opto 22 SoftPAC Project Data Forgery Issue Vulnerability (CNVD-2020-29560)

Opto 22 SoftPAC Project is an automation software suite from Opto 22 USA. The product is capable of providing industrial automation, process control, building automation, remote monitoring, data acquisition and industrial IoT. A data forgery issue vulnerability exists in Opto 22 SoftPAC Project...

buildah: Crafted input tar file may lead to local file overwrite during image build process

A path traversal flaw was found in Buildah. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTPs server and then write files to the user's system anywhere that the user has permissions...

buildah: Crafted input tar file may lead to local file overwrite during image build process

A path traversal flaw was found in Buildah. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTPs server and then write files to the user's system anywhere that the user has permissions...

DEBIAN-CVE-2020-8159

There is a vulnerability in actionpackpage-caching gem v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view...

UBUNTU-CVE-2020-8159

There is a vulnerability in actionpackpage-caching gem v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view...

PT-2020-2336

Name of the Vulnerable Software and Affected Versions Windows Print Spooler affected versions not specified Description An elevation of privilege issue exists due to the Windows Print Spooler service improperly allowing arbitrary writing to the file system. This could enable an attacker to run...

Zoho ManageEngine Desktop Central Path Traversal Vulnerability

Zoho ManageEngine Desktop Central DC is a desktop management solution from Zoho. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A path traversal...

CVE-2020-10859

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

Directory traversal

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2020-10859

The CVE-2020-10859 entry applies to Zoho ManageEngine Desktop Central (before 10.0.484). The vulnerability is a Directory Traversal in the AppDependency API that, when an authenticated user issues a crafted ZIP extraction request, allows arbitrary file writes on the target system. This is trigger...

CVE-2020-10859: Improper Limitation of a Pathname to a Restricted Directory

Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request...

CVE-2019-19102

A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip...

Design/Logic Flaw

Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash...

CVE-2020-8484

Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash...

CVE-2020-8485

Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash...

PT-2020-20168

Name of the Vulnerable Software and Affected Versions ABB System 800xA for MOD 300 all published versions Description The issue is related to insufficient protection of inter-process communication functions, allowing an authenticated attacker on the local system to inject data. This enables the...

PT-2020-20167

Name of the Vulnerable Software and Affected Versions ABB System 800xA for DCI all published versions Description The issue is related to insufficient protection of inter-process communication functions, allowing an authenticated attacker on the local system to inject data. This enables the...

PT-2020-10045

Name of the Vulnerable Software and Affected Versions B&R Automation Studio versions 4.0.x through 4.2.x Description A directory traversal issue in SharpZipLib, used by the upgrade service, allows unauthenticated users to write to specific local directories. This issue is also referred to as zip...