CVE-2019-9637

An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to...

CVE-2019-9637

An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to...

Unspecified Vulnerability in WordPress Media File Manager

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Media File Manager plugin is a media library folder/category management plugin used in it. An unspecified vulnerability exis...

kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4xattrsetentry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image...

AppArmor Filesystem Blacklisting Bypass

AppArmor: filesystem blacklisting can be bypassed by moving parents Some AppArmor policies attempt to blacklist access to specific directories while broadly granting write access to everything else. For example, the Firefox profile uses the user-files abstraction, which broadly permits write acce...

Google gVisor File Renaming Vulnerability

gVisor is Google's open source new sandbox container runtime environment . A file renaming vulnerability exists in Google gVisor. The vulnerability stems from Google gVisor's seccomp sandbox allowing access to the renameat system call. An attacker could exploit this vulnerability to rename files ...

DEBIAN-CVE-2018-10879

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4xattrsetentry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image...

CVE-2018-9134

filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...

File Renaming Vulnerability in HAIRUICMS v2.1.4 /FileManage/fsorename.asp File

HAIRUICMS HAIRUICMS is developed by HAIRUICMS based on Microsoft ASP and general ACCESS/MSSQL database. A file renaming vulnerability exists in the HAIRUICMS v2.1.4 /FileManage/fsorename.asp file. The vulnerability is caused by not filtering the file name suffix, resulting in the image can be...

The vulnerability of the mibFileServlet component of the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the mibFileServlet component in the HPE Intelligent Management Center PLAT software platform is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to rename arbitrary files and execute arbitrary code within the SYSTEM...

File Renaming Vulnerability in CMS Made Simple v2.2.5

CMS Made Simple is a simple, easy-to-use content management system developed using PHP, MySQL and Smarty template engines. A file renaming vulnerability exists in CMS Made Simple v2.2.5 due to the system failing to effectively filter input parameters. An attacker can exploit this vulnerability to...

Rename vulnerability in ourphp v1.8.0

Ourphp website building system is a php+mysql website building system. ourphp v1.8.0 version exists renaming vulnerability, the attacker will Trojan horse code injected into the edited file, rename the file as an executable script file, so as to obtain the website webshell...

BrightSign Digital Signage (4k242) File Upload Vulnerability

The BrightSign Digital Signage 4k242 is a multimedia playback device from BrightSign USA. A security vulnerability exists in BrightSign Digital Signage 4k242 using firmware version 6.2.63 and earlier. The vulnerability can be exploited to rename and modify files via the /tools.html web page...

bftpd Denial of Service Vulnerability

Bftpd is a small FTP server. A security vulnerability exists in the file rename function in Bftpd versions prior to 4.7. An attacker can exploit this vulnerability to cause a denial of service memory leak...

Memory corruption

In Bftpd before 4.7, there is a memory leak in the file rename function...

CVE-2017-16892

In Bftpd before 4.7, there is a memory leak in the file rename function...

CVE-2017-16892

The CVE-2017-16892 entry applies to Bftpd before 4.7, where the file-rename function contains a memory-leak bug. Multiple sources corroborate a memory-leak risk that can lead to denial of service; CVSS data shows a high impact for the 3.0 vector (HIGH availability impact) and medium base score (5...

CVE-2017-16892

In Bftpd before 4.7, there is a memory leak in the file rename function...

CVE-2015-6568

Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/filemanager/browse/ aka the filemanager does not prevent a change of a file extension to ".php" after originally using the parameter "filename" for uploading a JPEG image. Exploitation requires a...

Unrestricted file upload

Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/filemanager/browse/ aka the filemanager does not prevent a change of a file extension to ".php" after originally using the parameter "filename" for uploading a JPEG image. Exploitation requires a...