CVE-2019-18180

Improper Check for filenames with overly long extensions in PostMaster sending in email or uploading files e.g. attaching files to mails of OTRS Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: OTRS Community Edition 5.0.x version 5.0.38...

PSF-2019-15 Remove newline characters from uu encoding methods

Filenames passed to the UU encoding methods uu.py and uucodec.py that contain a newline character will overflow data into the UU content section. This can potentially be used to inject replace or corrupt data content in a file during the decode process. The fix removes newline characters from...

OS Command Injection

Ansible is vulnerable to OS command injection. The attack is possible because the module nxosfilecopy does not validate the remotefile parameter and directly uses the filenames from the parameter to copy files to a flash or bootflash on NXOS devices, allowing an attacker to inject malicious comma...

CVE-2014-1935

9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames...

CVE-2014-1935

9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames...

DEBIAN-CVE-2014-1935

9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames...

CVE-2014-1935

9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames...

Code injection

9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames...

UBUNTU-CVE-2014-1935

9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames...

CVE-2014-1935

9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames...

CVE-2014-1935

The CVE-2014-1935 entry affects 9base versions 1:6-6 and 1:6-7, where temporary files are created insecurely, producing predictable filenames. Root cause and impact are described in the connected data; CVSS details from NVD indicate a base score of 5.3 (MEDIUM) for CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S...

CVE-2014-1935

9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames...

Arbitrary File Overwrite

libqb is vulnerable to arbitrary file overwrite. An attacker is able to overwrite arbitrary files via a symlink attack due to the usage of predictable filenames under /dev/shm and /tmp without OEXCL...

SUSE SLES12 Security Update : samba (SUSE-SU-2019:2893-1)

This update for samba fixes the following issue : CVE-2019-10218: Fixed a path injection caused by filenames containing path separators bso14071 bsc1144902. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE-SU-2019:2893-1 Security update for samba

This update for samba fixes the following issue: - CVE-2019-10218: Fixed a path injection caused by filenames containing path separators bso14071 bsc1144902...

cPanel Authorization Issues Vulnerability (CNVD-2019-36140)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An authorization issue vulnerability exists in versions of cPanel prior to 11.54.0.4. The vulnerability stems from a lack of...

CloudBees Jenkins Aqua MicroScanner Plugin Elevation of Privilege Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Dependency Graph Viewer Plugin is used in...

EulerOS 2.0 SP3 : gimp (EulerOS-SA-2019-2021)

According to the versions of the gimp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple use-after-free vulnerabilities were found in GIMP in the channel and layer properties parsing process when loading XCF files.An attacker...

ruby: Command injection vulnerability in Net::FTP

It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with...

Cross-Site Scripting

Overview All versions of snekserve are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available...