9351 matches found
Amazon Linux AMI : ruby22 / ruby23 (ALAS-2017-906)
SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands in Net::SMTP A SMTP command injection flaw was found in the way Ruby's Net::SMTP module handled CRLF sequences in certain SMTP commands. An attacker could potentially use this flaw to inject SMTP commands in a SMTP session...
Chef Software Directory Traversal Vulnerability
Chef Software is a set of server application configuration tools written in Ruty and Erlang by Chef Software. mixlib-archive is one of the gem extraction archive tools. A directory traversal vulnerability exists in Chef Software in versions 0.3.0 and earlier of mixlib-archive. A remote attacker c...
CVE-2017-7549
A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploi...
CVE-2017-7549: Insecure Temporary File
A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploi...
Moderate: Red Hat Security Advisory: instack-undercloud security, bug fix, and enhancement update
An update for instack-undercloud is now available for Red Hat OpenStack Platform 11.0 Ocata. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2017-1452
IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 includes DB2 Connect Server could allow a local user to obtain elevated privilege and overwrite DB2 files. IBM X-Force ID: 128180...
CVE-2017-1452
CVE-2017-1452 affects IBM DB2 LUW (Linux/UNIX/Windows) including DB2 Connect Server and allows a local user to escalate privileges and overwrite DB2 files. Affected: DB2 9.7, 10.1, 10.5, 11.1; Windows is noted as not vulnerable in one bulletin. Base score ~6.7 (CVSS v3.0) with local, high-impact ...
Cisco IOS XE Software Arbitrary File Overwrite Vulnerability
Cisco ASR 920 Series Aggregation Services Routers are Cisco's ASR 920 series of multifunction routers.Cisco IOS XE Software is one of the operating systems dedicated to network devices. A security vulnerability exists in the USB-modem code of the IOS XE Software in the Cisco ASR 920 Series...
CVE-2017-6795
A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper inpu...
Cisco IOS XE Software for Cisco ASR 920 Series Routers Arbitrary File Overwrite Vulnerability
A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper inpu...
Debian DSA-3966-1 : ruby2.3 - security update
Multiple vulnerabilities were discovered in the interpreter for the Ruby language : - CVE-2015-9096 SMTP command injection in Net::SMTP. - CVE-2016-7798 Incorrect handling of initialization vector in the GCM mode in the OpenSSL extension. - CVE-2017-0900 Denial of service in the RubyGems client. ...
kamailio /tmp/kamailio_fifo Insecure Temporary File Creation Vulnerability
kamailio is an open source GPL-based SIP Session Initiation Protocol, Session Initiation Protocol server . A security vulnerability exists in /tmp/kamailiofifo in kamailio version 4.0.1. A remote attacker can exploit this vulnerability to perform a symbolic link attack, overwrite arbitrary files,...
RubyGems < 2.6.13 - Arbitrary File Overwrite Exploit
Exploit for linux platform in category local exploits There is no check for name field in metadata.gz. By assigning a maliciously crafted string like ../../../../../any/where to the field, an attacker can create an arbitrary file out of the directory of the gem, or even replace an existing file...
RubyGems 2.6.13 - Arbitrary File Overwrite
RubyGems 2.6.13 - Arbitrary File Overwrite There is no check for name field in metadata.gz. By assigning a maliciously crafted string like ../../../../../any/where to the field, an attacker can create an arbitrary file out of the directory of the gem, or even replace an existing file with a...
Debian: Security Advisory (DSA-3966-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
RubyGems < 2.6.13 - Arbitrary File Overwrite
There is no check for name field in metadata.gz. By assigning a maliciously crafted string like ../../../../../any/where to the field, an attacker can create an arbitrary file out of the directory of the gem, or even replace an existing file with a malicious file. Proof of Concept 1: Create a fil...
Design/Logic Flaw
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem...
DEBIAN-CVE-2017-0901
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem...
