CVE-2016-5839

WordPress before 4.5.3 allows remote attackers to bypass the sanitizefilename protection mechanism via unspecified vectors...

DEBIAN-CVE-2016-5839

WordPress before 4.5.3 allows remote attackers to bypass the sanitizefilename protection mechanism via unspecified vectors...

Design/Logic Flaw

WordPress before 4.5.3 allows remote attackers to bypass the sanitizefilename protection mechanism via unspecified vectors...

UBUNTU-CVE-2016-5839

WordPress before 4.5.3 allows remote attackers to bypass the sanitizefilename protection mechanism via unspecified vectors...

CVE-2016-5839

CVE-2016-5839 affects WordPress prior to 4.5.3, where the sanitize_file_name protection mechanism can be bypassed via unspecified vectors, enabling remote attackers to potentially bypass filename sanitization. Publicly documented in multiple advisories connected to WordPress, including Debian DSA...

wget -- HTTP to FTP redirection file name confusion vulnerability

Giuseppe Scrivano reports: On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename...

UBUNTU-CVE-2016-1236

Multiple cross-site scripting XSS vulnerabilities in 1 revision.php, 2 log.php, 3 listing.php, and 4 comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a a file or b directory in a repository...

CVE-2016-1236

Multiple cross-site scripting XSS vulnerabilities in 1 revision.php, 2 log.php, 3 listing.php, and 4 comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a a file or b directory in a repository...

WordPress iThemes Security Insecure Backup / Logfile Generation

-------------------------------------- ISSUE 1: Wordpress iThemes Security Better WP Security Insecure Backup/Logfile Generation access rights ================================================================================================== Description =========== A vulnerability has been found ...

Google Chrome < 50.0.2661.75 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 50.0.2661.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 201604stable-channel-update13 advisory. - Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attacke...

IIS Short Name Scanner - Scanner For IIS Short File Name Disclosure Vulnerability (using the tilde [~] character)

Scanner for IIS short file name 8.3 disclosure vulnerability by using the tilde character. Description Microsoft IIS contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered during the parsing of a request that contains a tilde character . This may allow a...

CVE-2016-0754

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name...

CVE-2016-0754

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name...

commons-fileupload: Arbitrary file upload via deserialization

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance...

DEBIAN-CVE-2015-7758

Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a 1 .aux, 2 .log, 3 .out, 4 .pdf, or 5 .toc extension for the file name, as demonstrated by .thesis.tex.aux...

UBUNTU-CVE-2015-8917

bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service NULL pointer dereference and crash via an invalid character in the name of a cab file...

MS15-130: Security update for Microsoft Uniscribe to address remote code execution: December 8, 2015

None None...

DEBIAN-CVE-2015-8105

Cross-site scripting XSS vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload...

UBUNTU-CVE-2015-8105

Cross-site scripting XSS vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload...

The vulnerability of the web application for data synchronization with ownCloud allows a perpetrator to trigger a service failure.

The vulnerability of file name handlers in web applications for data synchronization with ownCloud is related to resource management errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by assigning a specific file name...