DEBIAN-CVE-2015-1331

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/...

CVE-2015-1331

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/...

CVE-2015-1331

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/...

CVE-2015-1331: Improper Link Resolution Before File Access

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/...

MGASA-2015-0304 Updated lxc package fixes security vulnerability

Roman Fiedler discovered that LXC had a directory traversal flaw when creating lock files. A local attacker could exploit this flaw to create an arbitrary file as the root user CVE-2015-1331. Roman Fiedler discovered that LXC incorrectly trusted the container's proc filesystem to set up AppArmor...

GNU wget FTP Remote File Creation (CVE-2014-4877)

An input validation error exists in wget. The vulnerability can occur when wget retrieves files or directories over FTP that are or that contain symlinks. A remote attacker can exploit this vulnerability by creating a crafted FTP directory listing on a server and enticing a user to open the FTP...

yoyaku_v41 vulnerable to arbitrary file creation

Overview yoyakuv41 provided by Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains a vulnerability that may allow a remote attacker to create arbitrary files CWE-20. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#46674982: yoyaku_v41 vulnerable to arbitrary file creation

yoyakuv41 provided by Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains a vulnerability that may allow a remote attacker to create arbitrary files CWE-20. Impact An arbitrary file created by an attacker may result in arbitrary code being executed on the serve...

PT-2015-6024

Name of the Vulnerable Software and Affected Versions Webservice-DIC yoyaku version v41 Description The issue allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors. Recommendations For Webservice-DIC yoyaku version v41, at the moment,...

CVE-2015-2977: Improper Input Validation

Webservice-DIC yoyakuv41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors...

PHP 5.6.x < 5.6.8 Multiple Vulnerabilities - Linux

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

PT-2015-5215

Name of the Vulnerable Software and Affected Versions LXC versions 1.1.2 and earlier Description The issue allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/. Recommendations For LXC versions 1.1.2 and earlier, at the moment, there is no information about a newer...

WordPress Easy2Map Photos Plugin Directory Traversal Vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases.Easy2Map Photos is a tool for generating geotagged photo galleries. A directory traversal vulnerability exists in the WordPress Easy2Map...

PT-2015-6642

Name of the Vulnerable Software and Affected Versions Easy2Map plugin versions prior to 1.2.5 Description The issue allows remote attackers to create arbitrary files via a .. dot dot in the map id parameter in the includes/MapPinImageSave.php file. Recommendations For versions prior to 1.2.5,...

WordPress Easy2Map-Photos 1.09 SQL Injection

Title: SQL Injection in easy2map-photos wordpress plugin v1.09 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-08 Download Site: https://wordpress.org/plugins/easy2map-photos Vendor: Steven Ellis Vendor Notified: 2015-06-08, fixed in v1.1.0 Vendor Contact:...

WordPress Plugin Easy2Map 1.24 - SQL Injection

WordPress Plugin Easy2Map 1.24 - SQL Injection Title: SQL Injection in easy2map wordpress plugin v1.24 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-08 Download Site: https://wordpress.org/plugins/easy2map Vendor: Steven Ellis Vendor Notified: 2015-06-08, fixed in v1.25 Vendor Contact:...

CVE-2015-4616: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create arbitrary files via a .. dot dot in the mapid parameter...

Explorer+ File Manager vulnerable to directory traversal

Overview Explorer+ File Manager provided by Droidware UK contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Ryohei Koike of Sakura Information Systems Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

Stored XSS in "activity" application - ownCloud

Due to not sanitising all user provided input, the "activity" application shipped with the mentioned ownCloud versions is vulnerable to stored cross-site scripting attacks. The "activity" application is enabled by default in the ownCloud Community Edition and Enterprise Edition. Successful...

XtMediaPlayer 0.93 Memory Corruption

!/usr/bin/python + Author: SATHISH ARTHAR + Exploit Title: XtMediaPlayer - 0.93 Memory Corruption PoC + Date: 16-06-2015 + Category: DoS/PoC + Tested on: WinXp/Windows 7 + Vendor: http://downloads.sourceforge.net/project/xtmediaplayer/XtMediaPlayer/XtMediaPlayer0.93Win.rar + Sites:...