Null pointer dereference

The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server...

CVE-2018-14659

The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GFXATTRIOSTATSDUMPKEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr2' to trigger a state dump and create...

CVE-2018-14654

The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server...

CVE-2018-14654

The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GFXATTROPENTRYINKEY' xattrop to create arbitrary, empty files on the target server...

CVE-2018-13281

Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager DSM before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the filepath parameter...

CVE-2018-13281

Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager DSM before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the filepath parameter...

CVE-2018-13281

The CVE-2018-13281 entry affects Synology DiskStation Manager (DSM) prior to 6.2-23739-2, specifically the SYNO.Core.ACL component. The vulnerability allows remote authenticated users to determine the existence of files and obtain their metadata via the file_path parameter, constituting an inform...

CVE-2018-13281

Information exposure vulnerability in SYNO.Core.ACL in Synology DiskStation Manager DSM before 6.2-23739-2 allows remote authenticated users to determine the existence and obtain the metadata of arbitrary files via the filepath parameter...

glusterfs: "features/index" translator can create arbitrary, empty files

A flaw was found in the way glusterfs server handles client requests. A remote, authenticated attacker could set arbitrary values for the GFXATTROPENTRYINKEY and GFXATTROPENTRYOUTKEY during xattrop file operation resulting in creation and deletion of arbitrary files on glusterfs server node...

glusterfs: "features/index" translator can create arbitrary, empty files

A flaw was found in the way glusterfs server handles client requests. A remote, authenticated attacker could set arbitrary values for the GFXATTROPENTRYINKEY and GFXATTROPENTRYOUTKEY during xattrop file operation resulting in creation and deletion of arbitrary files on glusterfs server node...

CVE-2018-14654

A flaw was found in the way glusterfs server handles client requests. A remote, authenticated attacker could set arbitrary values for the GFXATTROPENTRYINKEY and GFXATTROPENTRYOUTKEY during xattrop file operation resulting in creation and deletion of arbitrary files on glusterfs server node...

DEBIAN-CVE-2018-18778

ACME minihttpd before 1.30 lets remote users read arbitrary files...

CVE-2018-18778

ACME minihttpd before 1.30 lets remote users read arbitrary files...

CVE-2018-18713

The function downsqlaction in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=downsql&name=../ URI...

CVE-2018-18778

ACME minihttpd before 1.30 lets remote users read arbitrary files...

CVE-2018-18778

ACME minihttpd before 1.30 lets remote users read arbitrary files...

FreeBSD : mini_httpd -- disclose arbitrary files is some circumstances (33c384f3-5af6-4662-9741-0acb21c7e499)

Jef Poskanzer reports : Prior versions allowed remote users to read arbitrary files in some circumstances. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors...

CVE-2018-18713

CVE-2018-18713 affects PHPYun 4.6. The vulnerability is in the function down_sql_action() of /admin/model/database.class.php, allowing remote attackers to read arbitrary files via directory traversal using the URI m=database&c=down_sql&name=../. Impact is reading local files; no in-field exploit ...

DEBIAN-CVE-2018-15687

A race condition in chownone of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239...

CVE-2018-15687

A race condition in chownone of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239...