PT-2015-6825 · Red Hat +1 · Abrt +2

Name of the Vulnerable Software and Affected Versions: ABRT versions prior to 2.7.1 Description: The issue allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp. This is related to the...

Ganglia Web Frontend < 3.5.1 - PHP Code Execution

Assuming that ganglia is installed on the target machine at this path:/var/www/html/ganglia/ 2. Assuming the attacker has minimal access to the target machine and can write to "/tmp". There are several methods where a remote attacker can also trigger daemons or other system processes to create...

Ganglia Web Frontend PHP Code Execution

...

Ganglia Web Frontend 3.5.1 - PHP Code Execution

Ganglia Web Frontend 3.5.1 - PHP Code Execution...

Cisco Nexus 9000 Series NX-OS '/tmp' Directory File Resource Consumption Vulnerability

Cisco Nexus is a data center-class switch from Cisco. A security vulnerability exists in the Cisco Nexus 9000 Series NX-OS that allows an authenticated user to copy oversized files to the '/tmp' directory, and an error occurs in the processing of the files, which can consume a large amount of...

PT-2015-7578

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.85.3 Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an attachment to a new ticket and then accessing it directly. This is achieved ...

PT-2015-1952

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 2.3.0 Description The issue is related to errors in the code of the slirp smb function in the net/slirp.c component of the QEMU hardware emulator. This can be exploited by a local attacker using a specially crafted file,...

SUSE SLES10 / SLES11 Security Update : ibutils (SUSE-SU-2013:1193-1) (deprecated)

Various tmp races in ibdiagnet of ibutils have been fixed that could have been used by local attackers on machines where infiband was debugged to gain privileges. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

Fedora 22 : texlive-2014-8.20140525_r34255.fc22 (2015-7564)

insecure use of /tmp in mktexlsr Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : ctdb (MDVSA-2015:177)

Updated ctdb packages fix security vulnerability : ctdb before 2.5 is vulnerable to symlink attacks to due the use of predictable filenames in /tmp, such as /tmp/ctdb.socket CVE-2013-4159. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

CVE-2013-6501

The default soap.wsdlcachedir setting in 1 php.ini-production and 2 php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the getsdl...

CVE-2013-6501

The default soap.wsdlcachedir setting in 1 php.ini-production and 2 php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the getsdl...

CVE-2015-1587

Unrestricted file upload vulnerability in filetoindex.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/...

CVE-2014-9465

senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform ZCP 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service /tmp disk consumption by uploading a large number of files...

PT-2015-5371

Name of the Vulnerable Software and Affected Versions Maarch LetterBox versions 2.8 and earlier GEC/GED versions 1.4 and earlier Description The issue allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable...

CVE-2015-1587: Undefined Security Weakness

Unrestricted file upload vulnerability in filetoindex.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/...

Updated zarafa packages fix CVE-2014-9465 and some packaging issues

Updated zarafa packages fix security vulnerability: Robert Scheck discovered a flaw in Zarafa WebAccess = 7.0.0 and Zarafa WebApp that could allow a remote unauthenticated attacker to exhaust the disk space of /tmp CVE-2014-9465. This update also adds some patches from Robert Scheck which correct...

CVE-2015-1458

Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcoreenableshellaccess and executing the "shell" command...

Command injection

Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcoreenableshellaccess and executing the "shell" command...

PT-2015-5298

Name of the Vulnerable Software and Affected Versions Fortinet FortiAuthenticator version 3.0.0 Description The issue allows local users to bypass intended restrictions and gain privileges. This is achieved by creating a specific file, /tmp/privexec/dbgcore enable shell access, and then executing...