PHP 4.x5.05.1 with Sendmail Mail Function - additional_param Arbitrary File Creation

PHP 4.x5.05.1 with Sendmail Mail Function - additionalparam Arbitrary File Creation source: https://www.securityfocus.com/bid/16878/info PHP is prone to multiple input-validation vulnerabilities that could allow 'safemode' and 'openbasedir' security settings to be bypassed. These issues reside in...

[eVuln] PerlBlog Multiple Vulnerabilities

New eVuln Advisory: PerlBlog Multiple Vulnerabilities http://evuln.com/vulns/81/summary.html --------------------Summary---------------- eVuln ID: EV0081 CVE: CVE-2006-0780 CVE-2006-0781 CVE-2006-0782 Software: PerlBlog Sowtware's Web Site: http://www.chronicled.org/perlblog/ Versions: 1.09b 1.09...

GLSA-200602-14 : noweb: Insecure temporary file creation

The remote host is affected by the vulnerability described in GLSA-200602-14 noweb: Insecure temporary file creation Javier Fernandez-Sanguino has discovered that the lib/toascii.nw and shell/roff.mm scripts insecurely create temporary files with predictable filenames. Impact : A local attacker...

CVE-2006-0782: Undefined Security Weakness

Unspecified vulnerability in weblog.pl in PerlBlog 1.09b and earlier allows remote attackers to create arbitrary files and possibly execute arbitrary code via unspecified attack vectors related to improper handling of 1 the reply parameter, possibly involving injection of 2 the name parameter and...

CVE-2006-0575

The CVE-2006-0575 issue affects Fcron versions 2.9.5 and 3.0.0 in the convert-fcrontab utility. It allows remote attackers to create or overwrite arbitrary files through directory traversal with ".." sequences and a symlink attack on the temporary file used during conversion, enabling potentially...

CVE-2006-0575: Undefined Security Weakness

convert-fcrontab in Fcron 2.9.5 and 3.0.0 allows remote attackers to create or overwrite arbitrary files via ".." sequences and a symlink attack on the temporary file that is used during conversion...

CVE-2006-0512

PADL MigrationTools 46 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the temporary files, which are not properly created by 1 migrateallonline.sh, 2 migratealloffline.sh, 3 migrateallnetinfoonline.sh, 4 migrateallnetinfooffline.s...

CVE-2005-4690: Undefined Security Weakness

Six Apart Movable Type 3.16 allows local users with blog-creation privileges to create or overwrite arbitrary files of certain types such as HTML and image files by selecting an arbitrary directory as a blog's top-level directory. NOTE: this issue can be used in conjunction with CVE-2005-3102 to...

CVE-2006-0478: Undefined Security Weakness

CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the...

ISAA-2006-001.txt

============================================= INTERNET SECURITY AUDITORS ALERT 2006-001 - Original release date: January 09, 2006 - Last revised: January 13, 2006 - Discovered by: Jesus Olmos Gonzalez - Severity: 4/5 ============================================= I. VULNERABILITY...

Farmers WIFE FTP Server Multiple Command Traversal Arbitrary File Creation

The remote host appears to be running Farmers WIFE, a commercial facilities, scheduling, and asset management package targeted at the media industry. The version of Farmers WIFE installed on the remote host includes an FTP server that reportedly is vulnerable to directory traversal attacks. A use...

CVE-2006-0319: Undefined Security Weakness

Directory traversal vulnerability in the FTP server port 22003/tcp in Farmers WIFE 4.4 SP1 allows remote attackers to create arbitrary files via ".." dot dot sequences in a 1 PUT, 2 SIZE, and possibly other commands...

[ISecAuditors Advisories] Arbitrary remote file creation in 123flashchat server

============================================= INTERNET SECURITY AUDITORS ALERT 2006-001 - Original release date: January 09, 2006 - Last revised: January 13, 2006 - Discovered by: Jesus Olmos Gonzalez - Severity: 4/5 ============================================= I. VULNERABILITY...

CVE-2006-0223: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Shanghai TopCMM 123 Flash Chat Server Software 5.1 allows attackers to create or overwrite arbitrary files on the server via ".." dot dot sequences in the username field...

Ubuntu 4.10 : vim vulnerabilities (USN-61-1)

Javier Fernandez-Sanguino Pena noticed that the auxillary scripts 'tcltags' and 'vimspell.sh' created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the script either by calling it...

Mandrake Linux Security Advisory : graphviz (MDKSA-2005:188)

Javier Fernndez-Sanguino Pea discovered insecure temporary file creation in graphviz, a rich set of graph drawing tools, that can be exploited to overwrite arbitrary files by a local attacker. The updated packages have been patched to address this issue. %NASLMINLEVEL 70300 C Tenable Network...

[SECURITY] [DSA 927-1] New tkdiff packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 927-1 [email protected] http://www.debian.org/security/ Martin Schulze December 27th, 2005 http://www.debian.org/security/faq -...

CVE-2005-3657: Undefined Security Weakness

The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog methods in the MCINSTALL.McLog object...

CVE-2003-1280: Undefined Security Weakness

Directory traversal vulnerability in cgihtml 1.69 allows remote attackers to overwrite and create arbitrary files via a .. dot dot in multipart/form-data uploads...

fetchmail security announcement 2005-02 (CVE-2005-3088)

fetchmail-SA-2005-02: security announcement Topic: password exposure in fetchmailconf Author: Matthias Andree Version: 1.02 Announced: 2005-10-21 Type: insecure creation of file Impact: passwords are written to a world-readable file Danger: medium Credits: Thomas Wolff, Miloslav Trmac for pointin...