The vulnerability of the web application for data synchronization with ownCloud allows a perpetrator to trigger a service failure.

The vulnerability of file name handlers in web applications for data synchronization with ownCloud is related to resource management errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by assigning a specific file name...

ownCloud Server Denial of Service Vulnerability

ownCloud Server is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek; ownCloud Server is a server edition. A denial of service vulnerability exists in ownCloud Server versions prior to 6.0.8, 8.0.x versions prior to 8.0.4 and 7.0.x versions...

ownCloud Server Cross-Site Scripting Vulnerability

ownCloud Server is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek. ownCloud Server is a server version. A cross-site scripting vulnerability exists in ownCloud Server versions prior to 7.0.5 and 8.0.4 and prior to 8.0.x. The vulnerability...

Design/Logic Flaw

The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service infinite loop and log file consumption via crafted endpoint...

Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2015-06712)

Revive Adserver is an open source ad management system from the Revive Adserver team. A cross-site scripting vulnerability exists in the plugin upgrade form of Revive Adserver versions prior to 3.2.2, which can be exploited by a remote attacker to inject arbitrary Web script or HTML with the help...

Mageia: Security Advisory (MGASA-2015-0352)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the NX-OS network operating system allows a hacker to execute arbitrary operating system commands.

The vulnerability of the NX-OS network operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor, operating locally, to execute arbitrary commands on the operating system by using special symbols in file names...

PT-2016-3297 · Gnu +3 · Gnu Tar +3

Name of the Vulnerable Software and Affected Versions: GNU tar versions 1.14 through 1.29 Description: The issue is related to a directory traversal vulnerability in the safer name suffix function. This vulnerability might allow remote attackers to bypass an intended protection mechanism and writ...

Oracle: Security Advisory (ELSA-2015-3054)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Cordova plugin cordova-plugin-file-transfer vulnerable to HTTP header injection

Overview cordova-plugin-file-transfer, a plugin for Apache Cordova provided by the Apache Software Foundation, provides functionality to upload and download files in applications created by Apache Cordova. It also provides functionality to add HTTP headers. Android applications that use...

Login-utils Denial of Service Vulnerability

util-linux is a set of software packages for Linux systems and contains a variety of system administration tools, login-utils is one of the login tools. A security vulnerability exists in login-utils that could be exploited by a local attacker to cause a file name conflict and conduct a denial of...

Information disclosure

The GetResource servlet in Pentaho Business Analytics BA Suite 4.5.x, 4.8.x, and 5.0.x through 5.2.x and Pentaho Data Integration PDI Suite 4.3.x, 4.4.x, and 5.0.x through 5.2.x does not restrict access to files in the pentaho-solutions/system folder, which allows remote attackers to obtain...

Synology Download Station Cross-Site Scripting Vulnerability

Synology Download Station is a set of web-based download applications from Synology. A cross-site scripting vulnerability exists in the 'Create download task via file upload' feature of Synology Download Station prior to version 3.5-2962, which can be exploited to inject arbitrary web script or...

Researchers Outline Bugs in Yahoo, PayPal, Magento

Researchers recently discovered a smattering of vulnerabilities in web applications and mobile applications belonging to companies like Yahoo, PayPal, Magento, and Shopify that could have led to account theft, session hijacking, and phishing, among other consequences. Hadji Samir, Ebrahim Hegazy,...

MGASA-2015-0352 Updated util-linux packages fix CVE-2015-5224

Updated util-linux packages fix security vulnerability: The chfn and chsh commands in util-linux's login-utils are vulnerable to a file name collision due to incorrect mkstemp usage. If the chfn and chsh binaries are both setuid-root they eventually call mkostemp in such a way that an attacker...

Updated util-linux packages fix CVE-2015-5224

Updated util-linux packages fix security vulnerability: The chfn and chsh commands in util-linux's login-utils are vulnerable to a file name collision due to incorrect mkstemp usage. If the chfn and chsh binaries are both setuid-root they eventually call mkostemp in such a way that an attacker...

PT-2017-6832

Name of the Vulnerable Software and Affected Versions util-linux affected versions not specified Description The issue is related to the mkostemp function in login-utils, which can be exploited by remote attackers to cause file name collision and potentially other attacks when used incorrectly...

Amazon Linux: Security Advisory (ALAS-2011-11)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Threat Outbreak Alert RuleID7930: Email Messages Distributing Malicious Software on July 25, 2016

Medium Alert ID: 40616 First Published: 2015 August 21 13:42 GMT Last Updated: 2016 July 26 12:25 GMT Version: 56 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID7930 and...

PEframe - Tool to perform static analysis on Portable Executable malware

PEframe is a open source tool to perform static analysis on Portable Executable malware. Usage $ peframe malware.exe $ peframe --option malware.exe Options --json Output in json --import Imported function and dll --export Exported function and dll --dir-import Import directory --dir-export Export...