CVE-2010-3490: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. dot dot in the usersnum parameter to admin/config.php, as...

Maple Maplet - File Creation / Command Execution (Metasploit)

$Id: maplemaplet.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Immunity Canvas: MS10_061

Name| ms10061 ---|--- CVE| CVE-2010-2729 Exploit Pack| CANVAS Description| Microsoft Windows Print Spooler Arbitrary File Creation Notes| CVE Name: CVE-2010-2729 VENDOR: Microsoft MSADV: MS10-061 Repeatability: Note: Please refer to the Microsoft URLs to know exactly the conditions for when this...

CVE-2010-2729: Improper Input Validation

The Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when printer sharing is enabled, does not properly validate spooler access permissions, which allows remote attackers to create...

Mandriva Update for tomcat5 MDVSA-2010:176 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDVSA-2010:176 tomcat5 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability

This module exploits the RPC service impersonation vulnerability detailed in Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service to create a file. The working directory at the time is...

FreeBSD : p5-libwww -- possibility to remote servers to create file with a .(dot) character (3a7c5fc4-b50c-11df-977b-ecc31dd8ad06)

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a .' dot character, which allows remote servers to create or overwrite files via a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename, and...

Tplayer V1R10 - Denial of Service

!/usr/bin/python print "--------------------Exploit By 41.w4r10r------------------------------\n" print "-------------------41.w4r10r@gmail.com-----------------------------\n" print "----------------Tplayer V1R10 DoS Exploit------------------------------\n" print "-------------Vendor Site :...

lftp: multiple HTTP client download filename vulnerability [OCERT 2010-001]

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

tomcat: unexpected file deletion and/or alteration

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry...

tomcat: unexpected file deletion and/or alteration

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry...

Oracle Solaris - 'nfslogd' Insecure Temporary File Creation

source: https://www.securityfocus.com/bid/41637/info Oracle Solaris is prone to an insecure temporary file creation vulnerability. A local attacker can exploit this issue to overwrite arbitrary files with the privileges of the affected process. This will likely result in denial-of-service...

Oracle Solaris Management Console - WBEM Insecure Temporary File Creation

source: https://www.securityfocus.com/bid/41642/info The 'Solaris Management Console' sub component of Oracle Solaris creates temporary files in an insecure manner. An attacker with local access can exploit this issue to overwrite arbitrary files. This may result in denial-of-service conditions o...

PBS Pro race condition vulnerability

Application: PBS Pro part od PBS Works by Altair Engineering Affected version: 10.4 OS: Linux/UNIX CVE ID: pending Class: temporary file creation race condition Remote: no Threat: destroy arbitrary choosen file of other user Discovered: 02.02.2010 Discovered by: Bartlomiej Balcerek Background: PB...

MP3 Cutter 1.8 Crash Exploit

Exploit for windows platform in category dos / poc ============================ MP3 Cutter 1.8 Crash Exploit ============================ " Legion of Xtremers & Hackers Garage www.loxian.co.cc www.garage4hackers.com MP3 Cutter 1.8 Crash Exploit...

CVE-2010-2251

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

Debian Security Advisory DSA 2063-1 (pmount)

The remote host is missing an update to pmount announced via advisory DSA 2063-1. OpenVAS Vulnerability Test $Id: deb20631.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2063-1 pmount Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

MP3 Digitalbox 2.7.2.0 Stack Overflow

!/usr/bin/perl Mp3 Digitalbox 2.7.2.0 .mp3 Local Stack Overflow POC Author : v3n0m Site : http://yogyacarderlink.web.id/ Group : YOGYACARDERLINK Date : July, 02-2010 INDONESIA Software : Mp3 Digitalbox Version : 2.7.2.0 Other versions may also be affected Download : http://www.tsoft.aplus.pl/...

DEBIAN-CVE-2010-0831

Directory traversal vulnerability in the extractjar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in a non-initial pathname component in a filename within a .jar archive, a related issue to CVE-2005-1080. NOTE: this...

CVE-2010-1374: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in iChat in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, when AIM is used, allows remote attackers to create arbitrary files via directory traversal sequences in an inline image-transfer operation...