php: file path injection vulnerability in RFC1867 file upload filename

The rfc1867posthandler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request...

Puppet uses predictable filenames, allowing arbitrary file overwrite

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...

Google Chrome < 15.0.874.102 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is earlier than 15.0.874.102. It therefore is potentially affected by the following vulnerabilities : - Several URL bar spoofing errors exist related to history handling and drag-and-drop of URLs. CVE-2011-2845, CVE-2011-3875 - Whitespace ...

CVE-2011-3876

Google Chrome before 15.0.874.102 does not properly handle downloading files that have whitespace characters at the end of a filename, which has unspecified impact and user-assisted remote attack vectors...

CVE-2011-3876

Removed by vendor...

wget unsafe files creation

Local file is created with server controlled filename...

SmartFTP Filename Processing Unspecified Vulnerability

This host is installed with SmartFTP Client and is prone to unspecified vulnerability. OpenVAS Vulnerability Test $Id: gbsmartftpclientfilenamesunspecifiedvuln.nasl 7029 2017-08-31 11:51:40Z teissa $ SmartFTP Filename Processing Unspecified Vulnerability Authors: Antu Sanadi Copyright: Copyright ...

SmartFTP Filename Processing Unspecified Vulnerability

SmartFTP Client is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PHPWEB background holding SHELL editor capture NC vulnerability and fix-vulnerability warning-the black bar safety net

Just finished watching the TV idle to sleep, just looking for a CMS in this play, PHPWEB so bad Ah, the back-end editor since the existence of such a primary vulnerability, just to see one individual who said the capture after so modified: Only applicable to IIS.... apache didn't have to play...

CVE-2010-4871

Unspecified vulnerability in SmartFTP before 4.0 Build 1142 allows attackers to have an unknown impact via a long filename...

Design/Logic Flaw

Unspecified vulnerability in SmartFTP before 4.0 Build 1142 allows attackers to have an unknown impact via a long filename...

CVE-2010-4871

Unspecified vulnerability in SmartFTP before 4.0 Build 1142 allows attackers to have an unknown impact via a long filename...

CVE-2010-4871

CVE-2010-4871 affects SmartFTP prior to 4.0 Build 1142, where an unspecified vulnerability via a long filename is present. The vulnerability is described as having an unknown impact, with CVSSv2 base score 10.0 ( HIGH ). Connected sources consistently reference SmartFTP Client 4.0 and earlier bui...

KLA10330 Vulnerability in SmartFTP

An unspecified vulnerability was found in SmartFTP. By exploiting this vulnerability malicious users can conduct unknown vulnerability. This vulnerability can be exploited via a specially designed filename. Original advisories SmartFTP changelog Related products SmartFTP CVE list CVE-2010-4871...

BuzzyWall 1.3.2 File Disclosure

BuzzyWall 1.3.2 resolute.php Local File Disclosure Exploit Found by cr4wl3r @hackb0x d0rk: no d0rk f0r kiddi0ts Script: http://sourceforge.net/projects/buzzywall/files/buzzywall/ err0r c0de resolute.php ?PHP header "Content-type: image/jpeg"; $img = $GET'img'; header'Content-Disposition:...

CVE-2011-3976

Stack-based buffer overflow in AmmSoft ScriptFTP 3.3 allows remote FTP servers to execute arbitrary code via a long filename in a response to a LIST command, as demonstrated using 1 GETLIST or 2 GETFILE in a ScriptFTP script...

Ubuntu Update for puppet USN-1223-1

Ubuntu Update for Linux kernel vulnerabilities USN-1223-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN12231.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for puppet USN-1223-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This...

Ubuntu 10.04 LTS / 10.10 / 11.04 : puppet vulnerabilities (USN-1223-1)

It was discovered that Puppet unsafely opened files when the k5login type is used to manage files. A local attacker could exploit this to overwrite arbitrary files which could be used to escalate privileges. CVE-2011-3869 Ricky Zhou discovered that Puppet did not drop privileges when creating SSH...

TimeLive Time and Expense Tracking Multiple Vulnerabilities

The host is running TimeLive Time and Expense Tracking and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodtimelivetimeandexpensetrackingmultvuln.nasl 7029 2017-08-31 11:51:40Z teissa $ TimeLive Time and Expense Tracking Multiple Vulnerabilities Authors: Antu Sanadi...

Fedora 14 : maniadrive-1.2-32.fc14 / php-5.3.8-1.fc14 / php-eaccelerator-0.9.6.1-9.fc14 (2011-11537)

Security Enhancements and Fixes : - Updated cryptblowfish to 1.2. CVE-2011-2483 - Fixed crash in errorlog. Reported by Mateusz Kocielski - Fixed buffer overflow on overlog salt in crypt. - Fixed bug 54939 File path injection vulnerability in RFC1867 File upload filename. Reported by Krzysztof...