ZENworks Configuration Management doPost Arbitrary File Execution

The vulnerability of the doPost method in the Rtrlet class of the ZENworks Configuration Management software lies in the deficiencies in path name restriction. Exploiting this vulnerability allows a malicious actor to download and execute arbitrary files using unspecified vectors...

CVE-2016-0354: Unrestricted Upload of File with Dangerous Type

IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893...

CVE-2015-8352: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...

PT-2017-7401

Name of the Vulnerable Software and Affected Versions Zen Cart version 1.5.4 Description A directory traversal issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. dot dot in the act parameter to the "ajax.php" endpoint. Recommendations For Ze...

Foxit Reader command injection(CVE-2017-10951)and file writing Vulnerability(CVE-2017-10952)

A tale about Foxit Reader - Safe Reading mode and other vulnerabilities Some days ago someone send me the following link, which describes two vulnerabilities in Foxit Reader: http://thehackernews.com/2017/08/two-critical-zero-day-flaws-disclosed.html These two vulnerabilities are similar to the...

CVE-2017-3108

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability...

CVE-2017-3108

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability...

Privilege escalation

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability...

CVE-2017-3108

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability...

CVE-2017-3108: Unrestricted Upload of File with Dangerous Type

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability...

PT-2017-15658

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.2 and earlier Description A malicious file execution issue has been identified. Recommendations For Adobe Experience Manager versions 6.2 and earlier, update to a version later than 6.2 to resolve the issue...

NoMachine 5.3.9 - Local Privilege Escalation

NoMachine 5.3.9 - Local Privilege Escalation """ Exploit Title: NoMachine LPE - Local Privilege Escalation Date: 09/08/2017 Exploit Author: Daniele Linguaglossa Vendor Homepage: https://www.nomachine.com Software Link: https://www.nomachine.com Version: 5.3.9 Tested on: OSX CVE : CVE-2017-12763...

Security update for the Windows Error Reporting elevation of privilege vulnerability for and Windows Server 2008: August 8, 2017

Security update for the Windows Error Reporting elevation of privilege vulnerability for and Windows Server 2008: August 8, 2017 Summary This security update resolves a vulnerability in Windows Error Reporting WER. The vulnerability could allow elevation of privilege if successfully exploited by ...

Contao Directory Traversal Vulnerability (CNVD-2017-25541)

Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . A security vulnerability exists in Contao versions prior to 3.5.28 and 4.x versions prior to 4.4.1. A remote attacker can exploit the vulnerability...

PT-2017-11667

Name of the Vulnerable Software and Affected Versions Contao versions prior to 3.5.28 Contao versions 4.x prior to 4.4.1 Description The issue allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL. This can be exploited by a logged-in back-end...

CVE-2017-8004

The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance RSA IMG versio...

Unspecified Vulnerability in Mozilla Firefox and Firefox ESR for Windows (CNVD-2017-12556)

Mozilla Firefox for Windows is an open source web browser for the Windows platform from the Mozilla Foundation in the U.S. Firefox ESR for Windows is an extended support version of Firefox for the Windows platform. A security vulnerability exists in Mozilla Firefox for Windows versions prior to...

PT-2017-17931

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 52.2 Firefox versions prior to 54 Description The issue involves manipulation of the updater.ini contents used by the Mozilla Windows Updater, allowing for privilege escalation through the Mozilla Maintenance...

PT-2017-2229

Name of the Vulnerable Software and Affected Versions FortinetClient for Linux affected versions not specified Description The issue is related to insufficient access control in the SSL VPN software. It allows a remote attacker to execute arbitrary files with root privileges by replacing the...

CVE-2017-9067: Improper Limitation of a Pathname to a Restricted Directory

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...