GRR Authentication Bypass Vulnerability

GRR is an open source resource management tool. GRR suffers from an authentication bypass vulnerability that allows an attacker to upload malicious files and execute malicious code due to the lack of filtering of file names uploaded by the user...

The vulnerabilities of the Xymon network monitoring software allow a intruder to trigger a service failure or execute arbitrary code.

Multiple vulnerabilities in the xymond/xymond.c program of the Xymon network monitoring tool are caused by buffer overflow attacks. Exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code or cause a system crash due to the use of a long file name, which is...

TarDiff Command Injection Vulnerability

TarDiff is a package comparison tool developed by software developer Josef Spillner. A command injection vulnerability exists in TarDiff. The vulnerability can be exploited to inject arbitrary shell commands by using shell metacharacters in tar file names or filenames in tar files...

Apache Jetspeed Multiple Vulnerabilities (Mar 2016)

Apache Jetspeed is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:jetspeed"; if...

Arbitrary File Write

Overview Affected versions of cli use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the cli process has permission to write to. Proof of...

Fedora 23 : perl-IPTables-Parse-1.5-2.fc23 (2015-0c153d3319)

Update to IPTables-Parse-1.5 - Fix use of predictable temporary file names Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Threat Outbreak Alert RuleID4961KVR: Email Messages Distributing Malicious Software on September 24, 2016

Medium Alert ID: 43657 First Published: 2016 February 22 21:55 GMT Last Updated: 2016 October 3 12:49 GMT Version: 46 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID4961...

CVE-2016-1490

The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows allows remote attackers to obtain sensitive file names via a crafted file request to /list...

CVE-2016-1490

The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows allows remote attackers to obtain sensitive file names via a crafted file request to /list...

Design/Logic Flaw

The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows allows remote attackers to obtain sensitive file names via a crafted file request to /list...

CVE-2016-1490

The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows allows remote attackers to obtain sensitive file names via a crafted file request to /list...

Threat Outbreak Alert RuleID20491: Email Messages Distributing Malicious Software on February 20, 2016

Medium Alert ID: 43058 First Published: 2016 January 19 13:31 GMT Last Updated: 2016 February 22 16:57 GMT Version: 6 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20491...

Pitivi Arbitrary Command Execution Vulnerability

Pitivi is a suite of open source video editing software written in Python and based on GStreamer and GTK+. The software provides a timeline in order to achieve complete control over the video. A security vulnerability exists in Pitivi versions prior to 0.95, which stems from an error in the...

openSUSE Security Update : gummi (openSUSE-2015-956)

This update for gummi fixes the following issues : - CVE-2015-7758: Fix an exploitable issue caused by gummi setting predictable file names in /tmp; patch taken from debian patch tracker and submitted upstream bnc949682. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Amazon Linux AMI : perl-IPTables-Parse (ALAS-2015-627)

A vulnerability in perl-IPTables-Parse was found, when using predictable file names for its temporary files. This vulnerability allows attacker on a multi-user system to set up symlinks to overwrite any file the current user has write access to. C Tenable Network Security, Inc. The descriptive te...

Threat Outbreak Alert RuleID4626: Email Messages Distributing Malicious Software on June 16, 2016

Medium Alert ID: 42662 First Published: 2015 December 14 14:06 GMT Last Updated: 2016 July 11 13:44 GMT Version: 61 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID4626 an...

The vulnerability of the web application for data synchronization with ownCloud allows a hacker to inject arbitrary web or HTML code.

The vulnerability of the web application for data synchronization with ownCloud exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code using special symbols within the file name...

CVE-1999-0997

wu-ftp with FTP conversion enabled allows an attacker to execute commands via a malformed file name that is interpreted as an argument to the program that does the conversion, e.g. tar or uncompress...

CVE-2015-4717

The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service infinite loop and log file consumption via crafted endpoint...

The vulnerability of the Allied Telesyn TFTP Server allows a intruder to cause a service failure or execute arbitrary code.

The vulnerability of the Allied Telesyn TFTP Server arises due to an overflow in the buffer on the stack. Exploiting this vulnerability allows a malicious actor to cause service failures or execute arbitrary code when processing requests containing long file names in the Allied Telesyn TFTP Serve...