Design/Logic Flaw

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

ALPINE-CVE-2017-16544

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

CVE-2017-16544

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

DEBIAN-CVE-2017-1000100

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name longer than about 515 bytes, the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used...

CVE-2017-11497

Stack buffer overflow in hasplms in Gemalto ACC Admin Control Center, all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via language packs containing filenames longer than 1024 characters...

Stack overflow

Stack buffer overflow in hasplms in Gemalto ACC Admin Control Center, all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via language packs containing filenames longer than 1024 characters...

Devscripts Arbitrary File Write Vulnerability

Debian is a free operating system developed and maintained by the Debian Project. devscripts is a collection of system maintenance scripts. A security vulnerability exists in versions of devscripts prior to 2.15.7. The vulnerability can be exploited by remote attackers to overwrite arbitrary file...

Code injection

Audit before 2.4.4 in Linux does not sanitize escape characters in filenames...

CVE-2015-5186

Audit before 2.4.4 in Linux does not sanitize escape characters in filenames...

UBUNTU-CVE-2015-5186

Audit before 2.4.4 in Linux does not sanitize escape characters in filenames...

CVE-2015-5186

Audit before 2.4.4 in Linux does not sanitize escape characters in filenames...

New Locky Variant 'IKARUSdilapidated' Strikes Again

A second wave of the Locky ransomware variant called IKARUSdilapidated has been identified by security experts. The source of the ransomware is a botnet of zombie computers coordinated to launch phishing attacks that send emails and attachments appearing to come from a targeted recipient’s truste...

xzgrep Code Execution Vulnerability

xzgrep is a set of regular expression tools for searching compressed files. A security vulnerability exists in the scripts/xzgrep.in file in xzgrep, which stems from the program failing to properly handle filenames with semicolons. A remote attacker can exploit this vulnerability to execute...

Lutim cross-site scripting vulnerability (CNVD-2017-22587)

Lutim is a set of tools for storing, viewing, downloading, and sharing images. A cross-site scripting vulnerability exists in versions of Lutim prior to 0.8. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of specially crafted filenames...

ALPINE-CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

WordPress Newsletter Supsystic Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in Wordpress Newsletter Supsystic, which stems from an error...

WordPress Cross-Site Scripting Vulnerability (CNVD-2017-07303)

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress versions prior to 4.7.5, which stems from an error...

UBUNTU-CVE-2017-9061

In WordPress before 4.7.5, a cross-site scripting XSS vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename...

Predictable Filenames

netty-codec-http is vulnerable to predictable filenames for the temporary files. The vulnerability exists because it takes user provided file name as part of the temporary file name, allowing a malicious user to overwrite arbitrary files via a symlink attack...

Ninka Security Bypass Vulnerability

Ninka is a set of source code license identification tools. A security vulnerability exists in Ninka versions prior to 1.3.2. It can be exploited by remote attackers to obtain sensitive information or cause a denial of service process hang by means of a specially crafted filename...