Oracle Solaris - 'nfslogd' Insecure Temporary File Creation

source: https://www.securityfocus.com/bid/41637/info Oracle Solaris is prone to an insecure temporary file creation vulnerability. A local attacker can exploit this issue to overwrite arbitrary files with the privileges of the affected process. This will likely result in denial-of-service...

PBS Pro race condition vulnerability

Application: PBS Pro part od PBS Works by Altair Engineering Affected version: 10.4 OS: Linux/UNIX CVE ID: pending Class: temporary file creation race condition Remote: no Threat: destroy arbitrary choosen file of other user Discovered: 02.02.2010 Discovered by: Bartlomiej Balcerek Background: PB...

MP3 Cutter 1.8 Crash Exploit

Exploit for windows platform in category dos / poc ============================ MP3 Cutter 1.8 Crash Exploit ============================ " Legion of Xtremers & Hackers Garage www.loxian.co.cc www.garage4hackers.com MP3 Cutter 1.8 Crash Exploit...

Debian Security Advisory DSA 2063-1 (pmount)

The remote host is missing an update to pmount announced via advisory DSA 2063-1. OpenVAS Vulnerability Test $Id: deb20631.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2063-1 pmount Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

MP3 Digitalbox 2.7.2.0 Stack Overflow

!/usr/bin/perl Mp3 Digitalbox 2.7.2.0 .mp3 Local Stack Overflow POC Author : v3n0m Site : http://yogyacarderlink.web.id/ Group : YOGYACARDERLINK Date : July, 02-2010 INDONESIA Software : Mp3 Digitalbox Version : 2.7.2.0 Other versions may also be affected Download : http://www.tsoft.aplus.pl/...

DEBIAN-CVE-2010-0831

Directory traversal vulnerability in the extractjar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in a non-initial pathname component in a filename within a .jar archive, a related issue to CVE-2005-1080. NOTE: this...

p5-libwww -- possibility to remote servers to create file with a .(dot) character

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a .' dot character, which allows remote servers to create or overwrite files via a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename, and...

OpenForum 2.2 b005 - 'saveAsAttachment()' Method Arbitrary File Creation

source: https://www.securityfocus.com/bid/40364/info OpenForum is prone to a vulnerability that may allow remote attackers to create arbitrary files on a vulnerable system. Successful exploits will allow an attacker to create arbitrary files, which may then be executed to perform unauthorized...

Linux Mint 8 mintUpdate Insecure Temporary File Creation

====================================================================== Linux Mint 8 mintUpdate Insecure Temporary File Creation ====================================================================== Author: L4teral l4teral at gmail com Impact: Privilege Escalation Status: Update available...

CVE-2010-1512

Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file...

Maple Maplet File Creation and Command Execution

$Id: maplemaplet.rb 9212 2010-05-03 17:13:09Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Maple Maplet File Creation and Command Execution

This module harnesses Maple's ability to create files and execute commands automatically when opening a Maplet. All versions up to 13 are suspected vulnerable. Testing was conducted with version 13 on Windows. Standard security settings prevent code from running in a normal maple worksheet withou...

DEBIAN-CVE-2010-1161

Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files...

Null pointer dereference

The cifscreate function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service NULL pointer dereference and OOPS or possibly have unspecified other impact via a NULL nameidata aka nd field in a POSIX file-creation request to a server that support...

CVE-2010-1148

The cifscreate function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service NULL pointer dereference and OOPS or possibly have unspecified other impact via a NULL nameidata aka nd field in a POSIX file-creation request to a server that support...

CVE-2010-1148

The cifscreate function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service NULL pointer dereference and OOPS or possibly have unspecified other impact via a NULL nameidata aka nd field in a POSIX file-creation request to a server that support...

CVE-2010-1148

The cifscreate function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service NULL pointer dereference and OOPS or possibly have unspecified other impact via a NULL nameidata aka nd field in a POSIX file-creation request to a server that support...

Symlink attack with Solaris Update manager and Sun Patch Cluster

Symlink attack with Solaris Update manager and Sun Patch Cluster Larry W. Cashdollar Vapid Labs http://vapid.dhs.org 1/24/2010 With the GUI Sun Update Manager being used to install patches on a system local users can easily run scripts and create symlinks in an attempt to clobber files and...

Solaris Update manager and Sun Patch Cluster symlink vulnerability

Exploit for solaris platform in category local exploits ================================================================== Solaris Update manager and Sun Patch Cluster symlink vulnerability ================================================================== Symlink attack with Solaris Update manag...

Solaris Update Manager / Sun Patch Cluster Symlink Attack

Symlink attack with Solaris Update manager and Sun Patch Cluster Larry W. Cashdollar Vapid Labs http://vapid.dhs.org 1/24/2010 With the GUI Sun Update Manager being used to install patches on a system local users can easily run scripts and create symlinks in an attempt to clobber files and...