CVE-2012-4940: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. dot dot in 1 the fileName parameter in a download action to source/loggin/pagelogdwnfile.hsp, or the fileName parameter in 2 an...

PT-2012-3900

Name of the Vulnerable Software and Affected Versions devscripts versions prior to 2.12.3 Description The issue allows remote attackers to delete arbitrary files via a crafted .dsc or .changes file, probably related to a NULL byte in a filename. Recommendations For versions prior to 2.12.3, updat...

PT-2012-3292

Name of the Vulnerable Software and Affected Versions Open Journal Systems versions prior to 2.3.7 Description The issue concerns multiple directory traversal vulnerabilities in the iBrowser plugin library. These vulnerabilities allow remote authenticated users to delete or rename arbitrary files...

CVE-2012-3865

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. dot dot in a...

PT-2012-5048

Name of the Vulnerable Software and Affected Versions Puppet versions prior to 2.6.17 Puppet versions 2.7.x prior to 2.7.18 Puppet Enterprise versions prior to 2.5.2 Description A directory traversal issue allows remote authenticated users to delete arbitrary files on the puppet master server. Th...

CVE-2012-1174

The rmrfchildren function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."...

PT-2012-3105

Name of the Vulnerable Software and Affected Versions systemd versions prior to 44 Description The issue concerns the rm rf children function in util.c within the systemd-logind login manager. It allows local users to delete arbitrary files via a symlink attack on unspecified files related to use...

PT-2012-2474

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions 5.0.x through 5.0.2 Description The issue concerns the file-management scripts in the management GUI, allowing remote attackers to read or delete arbitrary files. Recommendations For Symantec Web Gateway versions...

Ubuntu Update for gdm-guest-session USN-1399-1

Ubuntu Update for Linux kernel vulnerabilities USN-1399-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN13991.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for gdm-guest-session USN-1399-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH,...

CVE-2012-1196: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the VulCore web service WSVulnerabilityCore/VulCore.asmx in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. dot dot in the filename parameter in a SetTaskLogByFile SOAP request...

PT-2012-3123

Name of the Vulnerable Software and Affected Versions Lenovo ThinkManagement Console version 9.0.3 Description A directory traversal issue exists in the VulCore web service, allowing remote attackers to delete arbitrary files. This is achieved by including a .. dot dot in the filename parameter...

Design/Logic Flaw

The 1 bin/invscoutClientVPDSurvey and 2 sbin/invscoutlsvpd programs in invscout.rte before 2.2.0.19 on IBM AIX 7.1, 6.1, 5.3, and earlier allow local users to delete arbitrary files, or trigger inventory scout operations on arbitrary files, via a symlink attack on an unspecified file...

PT-2012-1514

Name of the Vulnerable Software and Affected Versions invscout.rte versions prior to 2.2.0.19 Description The issue allows local users to delete arbitrary files or trigger inventory scout operations on arbitrary files via a symlink attack. This is related to the bin/invscoutClient VPD Survey and...

Design/Logic Flaw

NFRAgent.exe in Novell File Reporter 1.0.4.2 and earlier allows remote attackers to delete arbitrary files via a full pathname in an SRS OPERATION 4 CMD 5 request to /FSF/CMD...

PT-2011-4060

Name of the Vulnerable Software and Affected Versions Novell File Reporter versions 1.0.4.2 and earlier Description The issue allows remote attackers to delete arbitrary files by sending a full pathname in an SRS OPERATION 4 CMD 5 request to the "/FSF/CMD" API endpoint. Recommendations For Novell...

Ruby: Symlink race condition by removing directory trees in fileutils module

The FileUtils.removeentrysecure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink attack...

PT-2011-2344

Name of the Vulnerable Software and Affected Versions PHP version 5.3.5 Description The issue allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/. This is related to the Debian GNU/Linux /etc/cron.d/php5 cron job. Recommendations For PHP version...

PT-2011-2864

Name of the Vulnerable Software and Affected Versions FocalMedia.Net Quick Polls versions prior to 1.0.2 Description The issue allows remote attackers to read or delete arbitrary files due to directory traversal vulnerabilities. This can be achieved by using a .. dot dot in the p parameter in...

CVE-2011-1004

The FileUtils.removeentrysecure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink attack...

CVE-2009-4194

Directory traversal vulnerability in Golden FTP Server 4.30 Free and Professional, 4.50, and possibly other versions allows remote authenticated users to delete arbitrary files via a .. dot dot in the DELE command. NOTE: some of these details are obtained from third party information...