UBUNTU-CVE-2017-14804

The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots...

CVE-2017-14804

The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots...

CVE-2017-14804

Summary (CVE-2017-14804) : The vulnerability affects the build package prior to 20171128, which fails to validate directory names during extraction of build results, enabling writes outside the target buildroot. This is documented in multiple sources (OpenSUSE SUSE announcements, OSS updates, and...

Unbit uWSGI Stack Buffer Overflow Vulnerability

Unbit uWSGI is a set of open source application server that supports multiple languages . A stack buffer overflow vulnerability exists in the 'uwsgiexpandpath' function in the core/utils.c file in Unbit uWSGI 2.0.15 and earlier. An attacker can exploit this vulnerability to cause stack corruption...

CVE-2017-16962

The WebMail components Crystal, pronto, and pronto4 in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via 1 the location or details field of a Google Calendar invitation, 2 a crafted Outlook.com calendar aka Hotmail Calendar invitation, 3 e-mail granting access to a directory that h...

Brave Software: Brave: Admin Panel Access

Steps to reproduce While browsing through the https://blog.brave.com/admin, it is getting redirected to a admin login panel https://brave.ghost.io/ghost/signin/. Consequence An attacker can easily enumerate this admin panel with the url such as https://blog.brave.com/admin and with brute force...

DEBIAN-CVE-2016-1244

The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file...

OwnCloud Server and Nextcloud Server Cross-Site Scripting Vulnerabilities

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany.Nextcloud is an open source self-hosted file synchronization and sharing communication application platform.OwnCloud Server and Nextcloud Server are both a server version of one of them. A cross-site scriptin...

UBUNTU-CVE-2016-1236

Multiple cross-site scripting XSS vulnerabilities in 1 revision.php, 2 log.php, 3 listing.php, and 4 comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a a file or b directory in a repository...

CVE-2016-1236

Multiple cross-site scripting XSS vulnerabilities in 1 revision.php, 2 log.php, 3 listing.php, and 4 comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a a file or b directory in a repository...

WebSVN cross-site scripting vulnerability (CNVD-2016-02878)

WebSVN is a set of Web-based Subversion Repository browser. A cross-site scripting vulnerability in WebSVN's handling of directory names or filenames allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...

PHP 5.6.x < 5.6.19 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.19. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists in file ext/wddx/wddx.c in the phpwddxpopelement function when handling XML data. An unauthenticated,...

Microsoft Windows File and Directory Name Command Injection (MS12-048) - Ver2 (CVE-2012-0175)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way Windows handles specially crafted file and directory names. A remote attacker can exploit this issue by enticing a user to open a file or a directory with a specially...

F5 Networks BIG-IP : Rsync sender.c vulnerability (SOL15548)

Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the fname function. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

DEBIAN-CVE-2014-2528

kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' single quote character in the directory name, a different vulnerability than CVE-2014-2527...

CVE-2014-2528

kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' single quote character in the directory name, a different vulnerability than CVE-2014-2527...

Trend Micro OfficeScan 8.0 Client - Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/34642/info The Trend Micro OfficeScan Client is prone to a denial-of-service vulnerability because it fails to handle nested directories with excessively long names. Successfully exploits will crash the affected...

CVE-2013-7050

The getmainsourcedir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCANEXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name...

CVE-2012-0427

yast2-add-on-creator in SUSE inst-source-utils 2008.11.26 before 2008.11.26-0.9.1 and 2012.9.13 before 2012.9.13-0.8.1 allows local users to gain privileges via a crafted 1 file name or 2 directory name...

Core FTP < 2.2 build 1785 CWD Command Buffer Overflow

The version of Core FTP installed on the remote host is prior to 2.2 build 1785. It is, therefore, affected by a stack-based buffer overflow vulnerability because user-supplied input is not properly validated when handling directory names via the 'CWD' command. A remote attacker could potentially...