Arbitrary file deletion

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2017-18284

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

CVE-2017-18240: Improper Input Validation

The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL when the service is...

WolfCMS Cross-Site Scripting Vulnerability

Wolf CMS is a lightweight content management system written in PHP. A reflective cross-site scripting vulnerability exists in WolfCMS 0.8.3.1 in the "Create New File" and "Create New Directory" input boxes under the "File" tab. An attacker can exploit this vulnerability to conduct session...

PYSEC-2017-136

A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service...

CVE-2017-10931

The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files and cause information leaks such as system configuration...

CVE-2017-10931

The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files and cause information leaks such as system configuration...

Information Disclosure

craftcms/cms is vulnerable to information disclosure. The application does not ensure that the path passed is safe, allowing a malicious user to have access to any file in the craft/app directory...

JVN#61502349: Self-Extracting Encrypted Files created by AttacheCase may insecurely load Dynamic Link Libraries

AttacheCase is an open source file encryption software provided by HiBARA Software. It can also create self-extracting encrypted files. Self-extracting encrypted files created by AttacheCase contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries...

Design/Logic Flaw

A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are...

CVE-2017-3844

A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are...

CVE-2017-3844

A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are...

CVE-2017-3844: Improper Input Validation

A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are...

php: Out-of-bounds heap memory read in exif_read_data() caused by malformed input

The exifprocessIFDinJPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other impact via crafted header data...

The vulnerability of the PHP interpreter, which allows attackers to trigger a service failure or exert other effects.

The vulnerability of the exifprocessIFDinJPEG function ext/exif/exif.c in the PHP interpreter improperly checks the size of the IFD file. Exploiting this vulnerability may allow a malicious actor to trigger a service failure memory overflow or potentially cause other effects through specially...

Chrome 5 a vulnerability to be fixed, Google rewards finding vulnerabilities personnel 2W $ -bug-warning-the black bar safety net

Recently, the Google company published the announcement, urged the majority use Windows, Mac OS and Linux operating system user as soon as possible to update their terminals on the Chrome version, in order to eliminate the 5 vulnerability to bring security risks. On has aeration out of 5...

H2O Directory Traversal Vulnerability

H2O is a set of open source Web server software . H2O suffers from a directory traversal vulnerability. When the program uses the file.dir directive, a remote attacker can exploit the vulnerability to read arbitrary files with the help of a specially crafted URL...

Huawei AR1200 series routers the background code for any implementation-vulnerability warning-the black bar safety net

School to a group of routers, not with, then test the following There's a function System administration diagnostics Ping ! Constituency 045. png Capture code area POST http://192.168.1.119/view/main/config.cgi HTTP/1.1 Host: 192.168.1.119 Connection: keep-alive Content-Length: 3 7 2 Origin:...

SQL Injection Vulnerability in OA System of Guangdong Oriental Thinking Technology Co.

Ltd. OA system is a set of office automation system, can solve the enterprises and institutions, government agencies, office automation and paperless office and other issues. Ltd. OA system there are SQL injection vulnerabilities, there are vulnerabilities in the link:...

VeryPhoto 3.0 Command Injection

Document Title: =============== VeryPhoto v3.0 iOS - Command Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1401 Release Date: ============= 2015-01-13 Vulnerability Laboratory ID VL-ID: ==================================== 1401...