However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, if `-mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build -nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `-nofilesystem=host` protection. Normally this will not be done, so this is not problem.
At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. flatpak-builder applies `finish-args` last in the build. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. Path Traversal may lead to deletion of any directory when admin privileges are available.Īctive Directory Domain Services Elevation of Privilege Vulnerability.įlatpak is a Linux application sandboxing and distribution framework.
NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which. Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.įile and directory permissions have been corrected to prevent unintended users from modifying or accessing resources.ĬoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via.