CVE-2017-7501

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to...

ServerProtect Code Execution Root Privileges File Modification

The vulnerability of the ServerProtect security tool exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to modify arbitrary files or execute arbitrary code with root privileges, by exploiting the absence of software update checks...

Security Update for Microsoft SharePoint Enterprise Server 2013 (KB4011170) farm-deployment

A security vulnerability exists in Microsoft SharePoint Enterprise Server 2013 that could allow arbitrary code to run when a maliciously modified file is opened. This update resolves that vulnerability...

CVE-2017-1000115

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository...

DEBIAN-CVE-2017-1000115

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository...

CVE-2017-1000115: Improper Link Resolution Before File Access

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository...

CVE-2017-13996: Relative Path Traversal

A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files that non administrative users should not have access to, which could allow an attacker to create or modify files or execute arbitrary code...

CVE-2017-1000115

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository...

Command injection

The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname"...

CVE-2017-14610

bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root scrip...

CVE-2017-14609: Improper Initialization

The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname"...

CVE-2017-14483: Concurrent Execution using Shared Resource with Improper Synchronization

flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a...

Apport Service Privilege Escalation

The vulnerability of the Apport service on the Ubuntu operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor, operating locally, to obtain root privileges and modify arbitrary files by improperly handling permissions when creating...

GNU Patch Unauthenticated File Modification

The vulnerability of the Git-style programmatic Unix utility GNU Patch for operating systems like Ubuntu and Fedora is related to deficiencies in pathname restrictions for directories. Exploiting this vulnerability allows a malicious actor to remotely modify arbitrary files with the target user’s...

CVE-2017-12699: Incorrect Default Permissions

An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or modify original application files with malicious ones...

PT-2017-12654

Name of the Vulnerable Software and Affected Versions AzeoTech DAQFactory versions prior to 17.1 Description An issue with incorrect default permissions was found, allowing local, non-administrative users to potentially replace or modify original application files with malicious ones...

CVE-2017-14159

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, ...

CVE-2017-14102

MIMEDefang 2.80 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as...

CVE-2017-14102

MIMEDefang 2.80 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill "cat /pathname"" command, as...

PT-2017-12665

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description An issue with incorrect permission assignment for critical resources was found, allowing non-administrator accounts to modify multiple files and folders with ACLs that affect othe...