PT-2015-1273 · Red Hat +1 · Setroubleshoot +2

Name of the Vulnerable Software and Affected Versions: setroubleshoot versions prior to 3.2.22 Description: The issue is related to incorrect file name handling, which can be exploited by remote attackers to execute arbitrary commands by adding shell metacharacters to file names. This is...

Moderate: Red Hat Security Advisory: php security update

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for...

USN-2347-1 python-django vulnerabilities

Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...

USN-2347-1: Django vulnerabilities

Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...

RedHat Update for wget RHSA-2014:0151-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

TFTP Server文件名处理远程栈溢出漏洞

BUGTRAQ ID: 28462 TFTP Server是用于PXEBOOT的免费多线程TFTP服务器。 TFTP Server没有正确地处理用户所提交的超长文件名，如果用户提交了带有超长文件名的认证请求的话，就可能触发栈溢出，导致拒绝服务或执行任意指令。 achaldhir TFTP Server 1.4 achaldhir --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://sourceforge.net/projects/tftp-server/...

CVE-2007-6610

unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product...

CVE-2006-5869

Removed by vendor...

Tftpd32 GET/PUT Command File Name Handling Overflow

The remote host appears to be running Tftpd32, a tftpd server for Windows. The version of Tftpd32 installed on the remote host appears to be affected by a buffer overflow vulnerability involving long filenames. By leveraging this flaw, a remote attacker may be able to crash the server or to execu...

USN-248-1: unzip vulnerability

A buffer overflow was discovered in the handling of file name arguments. By tricking a user or automated system into processing a specially crafted, excessively long file name with unzip, an attacker could exploit this to execute arbitrary code with the user's privileges...

USN-90-1: Imagemagick vulnerability

Tavis Ormandy discovered a format string vulnerability in ImageMagick's file name handling. Specially crafted file names could cause a program using ImageMagick to crash, or possibly even cause execution of arbitrary code. Since ImageMagick can be used in custom printing systems, this also might...

Various FTP clients fail to account for pipe (|) characters in default file names

Overview Various FTP client implementations do not correctly handle files whose name begins with the "|" pipe character. Description Most FTP clients include a feature in which the remote filename is used as the local filename in a GET RETR operation. For example, many FTP clients support syntax...