Arbitrary file deletion

The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL when the service is...

CVE-2017-18240

The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL when the service is...

Command injection

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM cat...

CVE-2017-18226

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM cat...

CVE-2017-18226

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM cat...

CVE-2017-18226

CVE-2017-18226 affects Gentoo net-im/jabberd2 up to version 2.6.1, where the process creates/uses /var/run/jabber owned by the jabber user. This ownership could allow local attackers to modify a PID file and kill a root-owned process by exploiting a window between PID-file modification and the ro...

CVE-2017-18226

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM cat...

CVE-2017-18226: Incorrect Permission Assignment for Critical Resource

The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script executes a "kill -TERM cat...

Multiple Vulnerabilities in BEESCMS Version 4.0_R_20160525

BEESCMS is an enterprise website management system based on PHP+Mysql architecture. BEESCMS V4.0R20160525 version exists in the foreground global variable coverage, background login authentication bypass, background any file read, background any file modification vulnerability, attackers can use...

CVE-2018-7308: Cross-Site Request Forgery (CSRF)

A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any hosting account...

BrightSign Digital Signage (4k242) File Upload Vulnerability

The BrightSign Digital Signage 4k242 is a multimedia playback device from BrightSign USA. A security vulnerability exists in BrightSign Digital Signage 4k242 using firmware version 6.2.63 and earlier. The vulnerability can be exploited to rename and modify files via the /tools.html web page...

BrightSign Digital Signage - Multiple Vulnerablities

BrightSign Digital Signage - Multiple Vulnerablities Exploit Title: BrightSign Digital Signage Multiple Vulnerabilities Date: 12/15/17 Exploit Author: [email protected] Vectors: XSS, Directory Traversal, File Modification, Information Leakage The BrightSign Digital Signage 4k242 device...

BrightSign Digital Signage - Multiple Vulnerablities

Exploit for hardware platform in category web applications Exploit Title: BrightSign Digital Signage Multiple Vulnerabilities Date: 12/15/17 Exploit Author: email protected Vectors: XSS, Directory Traversal, File Modification, Information Leakage The BrightSign Digital Signage 4k242 device Firmwa...

Design/Logic Flaw

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below allows renaming and modifying files via /tools.html...

CVE-2017-17738

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below allows renaming and modifying files via /tools.html...

CVE-2017-17738

Summary: CVE-2017-17738 affects BrightSign Digital Signage (4k242) devices with firmware 6.2.63 and earlier. The vulnerability allows renaming and modifying files via the web page /tools.html, as described in CNVD/NVD entries for this device. Public write-access via a web interface is indicated, ...

CVE-2017-17738

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below allows renaming and modifying files via /tools.html...

CVE-2017-17738: Undefined Security Weakness

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below allows renaming and modifying files via /tools.html...

PT-2017-14978

Name of the Vulnerable Software and Affected Versions BrightSign Digital Signage 4k242 versions 6.2.63 and below Description The issue allows renaming and modifying files via the "/tools.html" API endpoint. Recommendations For versions 6.2.63 and below, consider restricting access to the...

CVE-2017-7501

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to...