NConf 1.3 Arbitrary File Creation

No description provided by source. Exploit Title: nconf file read and wrtite exploit Date: 2013/1/20 Exploit Author: [email protected] Software Link: http://sourceforge.net/projects/nconf/files/nconf/ Version: nconf 1.3 Tested on: Server: Apache/2.2.15 Centos PHP/5.3.3 nconf can modify th...

MacOSXLabs RsyncX 2.1 Insecure Temporary File Creation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11212/info RsyncX is reported to contain an insecure temporary file creation vulnerability. The result of this is that temporary files created by the application may use predictable filenames. A local attacker may exploit...

easy file sharing web server 5.8 - Multiple Vulnerabilities

No description provided by source. ------------------------------------------------------------------------ Software................Easy File Sharing Web Server Version 5.8 Vulnerability...........Persistent Cross-site Scripting Threat Level............Moderate 2/5...

Quest Toad for Oracle Explain Plan Display ActiveX Control (QExplain2.dll 6.6.1.1115) Remote File Creation / Overwrite PoC

No description provided by source. !-- Quest Toad for Oracle Explain Plan Display ActiveX Control QExplain2.dll 6.6.1.1115 Remote File Creation / Overwrite vendor site: http://www.quest.com/ file tested: QuestToad-Development-Suite-for-Oracle110R2.exe CLSID: F7014877-6F5A-4019-A3B2-74077F2AE126...

Cscope <= 15.5 Symlink Vulnerability Exploit

No description provided by source. / RXcscope exploit version 15.5 and minor / include stdio.h include stdlib.h include sys/types.h include unistd.h define BSIZE 64 int mainint ac, char av pidt cur; uint i=0, lst; char bufferBSIZE + 1; fprintfstdout, \n -- Cscope Exploit --\n\ version 15.5 and...

GOMPlayer 2.2.53.5169 (.wav) - Crash PoC

No description provided by source. Exploit Title: GOMPlayer Version 2.2.53.5169 .wav - Crash POC Date: 03-09-2013 Exploit Author: ariarat Software Link: http://download.cnet.com/GOM-Media-Player/3000-136324-10551786.html?part=dl-GOMMediaP&subj=dl&tag=button Version: 2.2.53.5169 Probably old versi...

HP Instant Support 1.0.22 - 'HPISDataManager.dll' ActiveX Control Arbitrary File Creation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/29535/info HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a vulnerability that lets attackers create and overwrite files with arbitrary, attacker-controlled content. Successful exploits may compromis...

Sun Connection Update Manager for Solaris Multiple Insecure Temporary File Creation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/38928/info Sun Connection Update Manager for Solaris creates temporary files in an insecure manner. An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting...

IRIX 6.5.x inpview Race Condition Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1530/info Certain versions of IRIX ship with a version of inpview that creates files in '/var/tmp/' in an insecure manner and is therefore prone to a race condition. InPerson's 'inpview' is a networked multimedia...

PHP 4.x/5.0/5.1 with Sendmail Mail Function additional_parameters - Argument Arbitrary File Creation

No description provided by source. source: http://www.securityfocus.com/bid/16878/info PHP is prone to multiple input-validation vulnerabilities that could allow 'safemode' and 'openbasedir' security settings to be bypassed. These issues reside in the 'mbsendmail' function, the 'mail' function, a...

CVE-2014-4151

CVE-2014-4151 affects AlienVault OSSIM prior to 4.8.0. The av-centerd SOAP service is vulnerable to a set_file handling flaw that allows a remote, unauthenticated attacker to write arbitrary files and execute arbitrary code with root privileges. The issue stems from inadequate input sanitization ...

openSUSE Security Update : subversion (openSUSE-SU-2013:1442-1)

This subversion update includes a security fix and several minor changes. - update to 1.7.13 bnc836245 - User-visible changes : - General - merge: fix bogus mergeinfo with conflicting file merges - diff: fix duplicated path component in '--summarize' output - raserf: ignore case when checking...

SuSE 11.3 Security Update : python-imaging (SAT Patch Number 9153)

This python-imaging update fixes the following two security issues : - Fixed insecure temporary file creation and handling CVE-2014-1932 / CVE-2014-1933. bnc863541 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE ...

Directory traversal

Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in Agent Manager in NetIQ Sentinel allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted pathname...

CVE-2014-1402

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with jinja2 in /tmp...

Munin: Multiple vulnerabilities

Background Munin is an open source server monitoring tool. Description Multiple vulnerabilities have been discovered in Munin. Please review the CVE identifiers referenced below for details. Impact A local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of...

CVE-2011-3152

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade...

CVE-2011-3152

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade...

AndExplorer vulnerable to directory traversal

Overview AndExplorer provided by LYSESOFT contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Ryohei Koike of Sakura Information Systems Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

CA ERwin Web Portal MIMM ConfigServiceProviderServlet Remote File Creation/Overwrite Vulnerability

This vulnerability allows remote attackers to overwrite arbitrary .xml files on a system with vulnerable installations of CA ERwin Web Portal's Meta Integration Metadata Management service. Authentication is not required to exploit this vulnerability. The specific flaw exists within the "Meta...