PT-2016-6200

Name of the Vulnerable Software and Affected Versions FortiWan versions prior to 4.2.5 Description The issue allows remote authenticated users to discover administrator cookies via a GET request to the linkreport/tmp/admin global page. Recommendations For versions prior to 4.2.5, update to versio...

Malware Information Sharing Platform Insecure Temporary File Creation Vulnerability

The Malware Information Sharing Platform MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and analyzing cybersecurity events and malware. A security vulnerability exists in the app/Controller/TemplatesController.php file in MISP...

CVE-2015-5719: Undefined Security Weakness

app/Controller/TemplatesController.php in Malware Information Sharing Platform MISP before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors...

PT-2016-6671

Name of the Vulnerable Software and Affected Versions libstorage, libstorage-ng, and yast-storage affected versions not specified Description The issue allows local users to potentially obtain sensitive information by reading a temporary file on disk. This is because passphrases for encrypted...

TOPSEC Firewalls - Remote Code Execution (ELIGIBLECANDIDATE)

Cookie: sessionid=command To this URL to send the POST package if the included file is saved in the/tmp directory a file named cgixxxxxx Behind the characters randomly So you can put sh script to write to the firewall of the tmp directory together with Execute permissions after execution...

CVE-2016-3100

kinit in KDE Frameworks before 5.23.0 uses weak permissions 644 for /tmp/xauth-xxx-y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file...

The vulnerability of the microprogrammed software of the D–Link DSR–500 router allows a malicious individual to gain access to user account information.

In the file system of the D–Link DSR–500 router, user passwords are stored publicly in the file /tmp/teamf1.cfg.ascii...

AirOS 6.x - Arbitrary File Upload

AirOS 6.x - Arbitrary File Upload EDB-Note Source: https://hackerone.com/reports/73480 Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a...

Dell KACE K1000 - Arbitrary File Upload (Metasploit)

Exploit for unix platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Dell KACE K1000 File Upload', 'Description' = %q This module exploits a...

Fedora 22 : xsupplicant-2.2.0-13.fc22 (2015-020f4b9400)

Fix security issue with tmp file naming. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

PT-2018-6055

Name of the Vulnerable Software and Affected Versions: sync-exec versions prior to 0.11.9 Description: The issue allows an attacker with low privileges on the server to potentially obtain confidential information from the buffer/tmp file used by the sync-exec module. This is because the tmp...

JShielder - LAMP/LEMP Secure Deployment

JSHielder is an Open Source tool developed to help SysAdmin and developers secure there Linux Servers in which they will be deploying any web application. This tool automates the process of installing all the necessary packages to host a web application and Hardening a Linux server with little...

PT-2016-1059

Name of the Vulnerable Software and Affected Versions Zarafa Collaboration Platform versions prior to 7.2.1 Description The issue is related to incorrect link resolution before file access in the zarafa-autorespond application, part of the Zarafa Collaboration Platform. This can be exploited by a...

CVE-2015-7442

consoleinst.sh in IBM Installation Manager before 1.7.4.4 and 1.8.x before 1.8.4 and Packaging Utility before 1.7.4.4 and 1.8.x before 1.8.4 allows local users to gain privileges via a Trojan horse program that is located in /tmp with a name based on a predicted PID value...

Code injection

consoleinst.sh in IBM Installation Manager before 1.7.4.4 and 1.8.x before 1.8.4 and Packaging Utility before 1.7.4.4 and 1.8.x before 1.8.4 allows local users to gain privileges via a Trojan horse program that is located in /tmp with a name based on a predicted PID value...

CVE-2015-7442

consoleinst.sh in IBM Installation Manager before 1.7.4.4 and 1.8.x before 1.8.4 and Packaging Utility before 1.7.4.4 and 1.8.x before 1.8.4 allows local users to gain privileges via a Trojan horse program that is located in /tmp with a name based on a predicted PID value...

CVE-2015-7442

The CVE-2015-7442 issue affects IBM Installation Manager (and IBM Packaging Utility) scripts, notably consoleinst.sh, with a local privilege escalation via a race condition in /tmp. An attacker could place a Trojan horse executable named based on a predictable PID value to run with administrator/...

CVE-2015-5273

The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool ABRT before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp...

Brocade Fabric OS 6.3.1b Weak System Configuration

Title: Brocade Fabric OS v6.3.1b - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.brocade.com Versions Reported: Kernel 2.6.14.2 + FabOS v6.3.1b + BootProm 1.0.9 version Kernel: 2.6.14.2 Fabric OS: v6.3.1b BootProm: 1.0.9 1 Default diagnostic accounts root and factory...

PT-2015-6825 · Red Hat +1 · Abrt +2

Name of the Vulnerable Software and Affected Versions: ABRT versions prior to 2.7.1 Description: The issue allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp. This is related to the...