Simple IOC and Incident Response Scanner: Loki

LOKI is a free and simple IOC scanner, a complete rewrite of main analysis modules of our full featured APT Scanner THOR. IOC stands for „Indicators of Compromise“. These indicators can be derived from published incident reports, forensic analyses or malware sample collections in your Lab. LOKI...

chromium-browser: overly permissive cross origin downloads

Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction...

[ASA-201803-2] mkinitcpio-busybox: arbitrary code execution

Arch Linux Security Advisory ASA-201803-2 ========================================= Severity: High Date : 2018-03-01 CVE-ID : CVE-2017-16544 Package : mkinitcpio-busybox Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-514 Summary ======= The package...

[ASA-201803-1] busybox: arbitrary code execution

Arch Linux Security Advisory ASA-201803-1 ========================================= Severity: High Date : 2018-03-01 CVE-ID : CVE-2017-16544 Package : busybox Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-512 Summary ======= The package busybox before versi...

ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

The "lazyinitialize" function in lib/resolv.rb did not properly process certain filenames. A remote attacker could possibly exploit this flaw to inject and execute arbitrary commands...

ruby: Command injection vulnerability in Net::FTP

It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with...

Node.js third-party modules: [public] Stored XSS in filenames in directory served by public

Hi Guys, public allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript. I put https://www.npmjs.com/package/public in Weakness section - 'Where is the stored content accessible?' because it does not allowed me to open report with...

The vulnerability of the Ohcount source code counting tool lies in the lack of measures to clean input data, allowing a hacker to execute arbitrary code.

The vulnerability of the Ohcount source code counting tool is related to the lack of measures to clean input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code as the user who runs Ohcount, by using specially created file names containing metasymbols...

Node.js third-party modules: [crud-file-server] Stored XSS in filenames when directory index is served by crud-file-server

Hi Guys, crud-file-server allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript. Module crud-file-server This package exposes a directory and its children to create, read, update, and delete operations over http...

cpio security bypass vulnerability

cpio is a set of file backup tools developed by the GNU Project for use in the UNIX operating system and as a file format. The tool supports depositing and reading files from cpio or tar-formatted archive packages. A security vulnerability exists in cpio 2.7 and later versions, which stems from t...

Arbitrary File Download Vulnerability in DayuCMS

DayuCMS is a marketing-centered CMS system that incorporates search engine algorithms to facilitate businesses and individual webmasters. DayuCMS has an arbitrary file download vulnerability. The vulnerability is caused by the function of the download file module does not filter the download file...

Design/Logic Flaw

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...

CVE-2014-4994

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...

CVE-2014-4994

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...

PT-2017-14477

Name of the Vulnerable Software and Affected Versions NetGain Systems Enterprise Manager version 7.2.730 build 1034 Description This issue allows remote attackers to delete arbitrary files on vulnerable installations. Although authentication is required to exploit this issue, the existing...

CVE-2017-17434

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemonfilterlist data structure in the recvfiles function in receiver.c and also does not apply the sanitizepaths protection mechanism to pathnames found in "xname follows" strings in...

Ruby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - 'NET::Ftp' Command Injection

While using NET::Ftp I realised you could get command execution through "malicious" file names. The problem lies in the gettextfileremotefile, localfile = File.basenameremotefile method. When looking at the source code, you'll note: def gettextfileremotefile, localfile = File.basenameremotefile,...

CVE-2017-14591: Improper Neutralization of Argument Delimiters in a Command

Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software...

Arbitrary File Deletion Vulnerability in the Pelco Sarix Pro Webcam set_param Program

pelco Sarix Professional is a video camera. An arbitrary file deletion vulnerability exists in the pelco Sarix Pro webcam setparam program. The vulnerability is caused due to the program not checking filenames when processing parameters, which can be exploited by an attacker to delete arbitrary...

Command injection

Ohcount 3.0.0 is prone to a command injection via specially crafted filenames containing shell metacharacters, which can be exploited by an attacker providing a source tree for Ohcount processing to execute arbitrary code as the user running Ohcount...