Haystack Arq for Mac Elevation of Privilege Vulnerability

Haystack Arq for Mac is a Mac-based file backup software from Haystack Software, USA. arqupdater and others are among the components. Based on the Mac platform Haystack Arq 5.10 and the previous version of the standardrestorer binary file there is a security vulnerability. A local attacker can...

CVE-2017-16945

The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted restore path...

CVE-2017-16928

The arqupdater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted update URL, as demonstrated by file:///tmp/blah/Arq.zip...

CVE-2017-16945: Incorrect Permission Assignment for Critical Resource

The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted restore path...

PT-2018-6369

Name of the Vulnerable Software and Affected Versions: Arq versions 5.10 and earlier Description: The issue allows local users to gain root privileges by writing to arbitrary files via a crafted restore path using the standardrestorer binary. Recommendations: For Arq versions 5.10 and earlier,...

PT-2018-6367

Name of the Vulnerable Software and Affected Versions: Arq versions 5.10 and earlier Description: The issue allows local users to gain root privileges by writing to arbitrary files via a crafted update URL. This can be achieved by using a malicious URL, such as file:///tmp/blah/Arq.zip, to exploi...

CVE-2017-16601

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

UBUNTU-CVE-2014-9485

Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...

PT-2018-4304 · Minizip · Minigzip

Name of the Vulnerable Software and Affected Versions: minizip versions prior to 1.1-5 Description: The issue is related to a directory traversal vulnerability in the do extract currentfile function in miniunz.c in miniunzip. This vulnerability might allow remote attackers to write to arbitrary...

CVE-2014-9485: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...

TransmissionRPC DNS Rebinding Vulnerability

Transmission is a free BitTorrent BT client developed by the Transmission project team for use on the Linux and Mac OS X platforms, which supports data encryption, corruption repair and seeding. A security vulnerability exists in Transmission 2.92 and earlier versions. A remote attacker can execu...

DEBIAN-CVE-2018-5702

Transmission through 2.92 relies on X-Transmission-Session-Id which is not a forbidden header for Fetch for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS...

CVE-2018-5702: Undefined Security Weakness

Transmission through 2.92 relies on X-Transmission-Session-Id which is not a forbidden header for Fetch for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS...

UBUNTU-CVE-2018-5702

Transmission through 2.92 relies on X-Transmission-Session-Id which is not a forbidden header for Fetch for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS...

Debian: Security Advisory (DLA-1243-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2018-17098

Name of the Vulnerable Software and Affected Versions: Transmission versions prior to 2.93 Description: The issue allows remote attackers to execute arbitrary RPC commands and write to arbitrary files via POST requests to "/transmission/rpc" in conjunction with a DNS rebinding attack. This is...

CVE-2014-4994

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...

PT-2018-4236

Name of the Vulnerable Software and Affected Versions gyazo gem version 1.0.0 Description The issue allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames. This is due to a problem in the lib/gyazo/client.rb file. Recommendations F...

PT-2018-4238

Name of the Vulnerable Software and Affected Versions VladTheEnterprising gem version 0.2 Description The issue allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.target host. This is possible due to a vulnerability in the lib/vlad/dba/mysql.rb file of the...

CVE-2014-4994: Improper Input Validation

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...