GHSA-J6QJ-J888-VVGQ Directory exposure in jetty

Impact If the $jetty.base directory or the $jetty.base/webapps directory is a symlink soft link in Linux, the contents of the $jetty.base/webapps directory may be deployed as a static web application, exposing the content of the directory for download. For example, the problem manifests in the...

Local file disclosure in PHPMailer

An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base...

GHSA-4X5H-CR29-FHP6 Local file disclosure in PHPMailer

An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base...

rubygems: Path traversal when writing to a symlinked basedir outside of the root

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in installlocation function of package.rb that can result in...

Core FTPSFTP Server 1.2 Build 589.42 - User domain Denial of Service (PoC)

Core FTPSFTP Server 1.2 Build 589.42 - User domain Denial of Service PoC Exploit Title: Core FTP/SFTP Server 1.2 - Build 589.42 - Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2019-02-13 Vendor Homepage: http://www.coreftp.com/ Software Link:...

rubygems: Path traversal when writing to a symlinked basedir outside of the root

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in installlocation function of package.rb that can result in...

PHP Information Disclosure Vulnerability (CNVD-2018-15089)

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language is mainly used for Web development and supports a variety of databases and operating systems. A security vulnerability exists in th...

UBUNTU-CVE-2018-10057

The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary locations on the server due to missing basedir restrictions absolute directory traversal...

DEBIAN-CVE-2017-5223

An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base...

UBUNTU-CVE-2017-5223

An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base...

PT-2017-16400 · Php +3 · Phpmailer +3

Name of the Vulnerable Software and Affected Versions: PHPMailer versions prior to 5.2.22 Description: An issue in PHPMailer's msgHTML method allows it to apply transformations to an HTML document, making it usable as an email message body. One transformation converts relative image URLs into...

DEBIAN-CVE-2014-1624

Race condition in the xdg.BaseDirectory.getruntimedir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once th...

PYSEC-2014-95

Race condition in the xdg.BaseDirectory.getruntimedir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once th...

UBUNTU-CVE-2014-1624

Race condition in the xdg.BaseDirectory.getruntimedir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once th...

Ruubik CMS 1.1.0 Local File Inclusion

Exploit Title: Ruubikcms v 1.1.0 /extra/image.php Local File Inclusion Vulnerability Date: 2011/10/16 Author: Sangyun YOO Software Link: http://ruubikcms.com/ruubikcms/download.php?f=ruubikcms110.zip Version: Ruubikcms v 1.1.0 Tested on: Windows 7 Starter K ---------------------------------------...

PHP-Fusion Local File Inclusion

Exploit Title: PHP-Fusion Local File Includes Vulnerability Date: 2010/08/15 Author: MoDaMeR Email: [email protected] My Sites : www.v4-team.com & www.hackteach.org Script home: http://www.phpfusion-ar.com download Script: http://www.phpfusion-ar.com/downloads.php?catid=1&downloadid=91 Version:all Tested...

PHP-Fusion Local File Inclusion Vulnerability

Exploit for php platform in category web applications ============================================= PHP-Fusion Local File Inclusion Vulnerability ============================================= Author: MoDaMeR Email: email protected My Sites : www.v4-team.com & www.hackteach.org Script home:...

PHP-Fusion - Local File Inclusion

PHP-Fusion - Local File Inclusion Exploit Title: PHP-Fusion Local File Includes Vulnerability Date: 2010/08/15 Author: MoDaMeR Email: [email protected] My Sites : www.v4-team.com & www.hackteach.org Script home: http://www.phpfusion-ar.com download Script:...

Dovecot 'base_dir' Insecure Permissions Security Bypass Vulnerability

This host has Dovecot installed and is prone to Security Bypass Vulnerability OpenVAS Vulnerability Test $Id: gbdovecotbasedirsecbypassvuln.nasl 4865 2016-12-28 16:16:43Z teissa $ Description: Dovecot 'basedir' Insecure Permissions Security Bypass Vulnerability Authors: Antu Sanadi Copyright:...

dovecot -- Insecure directory permissions

Dovecot author reports: Dovecot v1.2.x had been creating basedir and its parents if necessary with 0777 permissions. The basedir's permissions get changed to 0755 automatically at startup, but you may need to chmod the parent directories manually...