CVE-2014-0809: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Gapless Player SimZip aka Simple Zip Viewer application before 1.2.1 for Android allows remote attackers to overwrite or create arbitrary files via a crafted filename...

PT-2014-8699

Name of the Vulnerable Software and Affected Versions GNU binutils versions 2.24 and earlier Description The issue allows local users to delete arbitrary files or create arbitrary files via directory traversal vulnerabilities in GNU binutils. This can be achieved by using a .. dot dot or full pat...

CVE-2014-0804: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the CGENE Security File Manager Pro application 1.0.6 and earlier, and Security File Manager Trial application 1.0.6 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors...

CVE-2014-0805: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the NeoFiler application 5.4.3 and earlier, NeoFiler Free application 5.4.3 and earlier, and NeoFiler Lite application 2.4.2 and earlier for Android allows attackers to overwrite or create arbitrary files via unspecified vectors...

PT-2014-3850

Name of the Vulnerable Software and Affected Versions CGENE Security File Manager Pro versions 1.0.6 and earlier CGENE Security File Manager Trial versions 1.0.6 and earlier Description The issue allows attackers to overwrite or create arbitrary files via unspecified vectors, potentially leading ...

PT-2014-3851

Name of the Vulnerable Software and Affected Versions NeoFiler application versions 5.4.3 and earlier NeoFiler Free application versions 5.4.3 and earlier NeoFiler Lite application versions 2.4.2 and earlier Description The issue allows attackers to overwrite or create arbitrary files via...

CVE-2014-0802: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the aokitaka ZIP with Pass application 4.5.7 and earlier, and ZIP with Pass Pro application 6.3.8 and earlier, for Android allows attackers to overwrite or create arbitrary files via unspecified vectors...

tetra filer vulnerable to directory traversal

Overview tetra filer provided by Yuichiro Okuyama contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Ryohei Koike of Sakura Information Systems Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

CVE-2012-0420

zypp-refresh-wrapper in SUSE Zypper before 1.3.20 and 1.6.x before 1.6.166 allows local users to create files in arbitrary directories, or possibly have unspecified other impact, via a pathname in the ZYPPLOCKFILEROOT environment variable...

CVE-2012-0420: Undefined Security Weakness

zypp-refresh-wrapper in SUSE Zypper before 1.3.20 and 1.6.x before 1.6.166 allows local users to create files in arbitrary directories, or possibly have unspecified other impact, via a pathname in the ZYPPLOCKFILEROOT environment variable...

PT-2013-6076

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 9.11 and earlier Description A directory traversal issue exists in the license-upload interface of the Enterprise License Manager ELM component, allowing remote authenticated users to create...

CVE-2013-6688: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the license-upload interface in the Enterprise License Manager ELM component in Cisco Unified Communications Manager 9.11 and earlier allows remote authenticated users to create arbitrary files via a crafted path, aka Bug ID CSCui58222...

CVE-2013-6128: Undefined Security Weakness

The KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict SaveToFile method calls, which allows remote attackers to create or overwrite arbitrary files, and subsequently execute arbitrary programs, via the singl...

CVE-2013-6127: Improper Limitation of a Pathname to a Restricted Directory

The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls, which allows remote attackers to create or overwrite arbitrary files, and subsequently execute arbitrary programs, via the...

Cisco Unified Computing System Fabric Interconnect Arbitrary File Creation Vulnerability

A vulnerability in the fabric interconnect of the Cisco Unified Computing System could allow an authenticated, local attacker to execute commands with elevated privileges. The vulnerability is due to improper filtering of user-supplied parameters. An attacker could exploit this vulnerability by...

CVE-2012-4122: Improper Input Validation

The CLI parser in Cisco NX-OS allows local users to bypass intended access restrictions, and overwrite or create arbitrary files, via shell output redirection, aka Bug IDs CSCts56672 and CSCts56669...

PT-2013-1657

Name of the Vulnerable Software and Affected Versions Cisco NX-OS affected versions not specified Description The issue allows local users to bypass intended access restrictions and create or overwrite arbitrary files via shell output redirection. This is due to improper input filtering in the...

PT-2013-4472

Name of the Vulnerable Software and Affected Versions AXIS Media Control AMC ActiveX control AxisMediaControlEmb.dll version 6.2.10.11 Description The issue allows remote attackers to create or overwrite arbitrary files. This can be achieved by providing a file path to certain methods, specifical...

CVE-2013-3543: Undefined Security Weakness

The AXIS Media Control AMC ActiveX control AxisMediaControlEmb.dll 6.2.10.11 for AXIS network cameras allows remote attackers to create or overwrite arbitrary files via a file path to the 1 StartRecord, 2 SaveCurrentImage, or 3 StartRecordMedia methods...

Arbitrary file creation in AbstractRendererExporterImpl

To reproduce: 1. Create a new space. 2. Create a new page. 3. Attach a file called test.txt to the page. 3. Edit the page, and add an image with the URL: code /confluence/s/download/attachments/pageid//../../../../../../../../../../../../tmp/test.txt code \pageid\ must be replaced with the actual...