2474 matches found
Fortinet FortiAnalyzer and FortiManager 'Filenames' HTML Injection Vulnerability
Fortinet FortiManager is a centralized network security management solution; Fortinet FortiAnalyzer is a centralized network security reporting solution. An HTML injection vulnerability exists in FortiAnalyzer and FortiManager 'Filenames' that could be exploited by an attacker to steal cookie-bas...
HelpDeskZ 1.0.2 - Arbitrary File Upload
HelpDeskZ 1.0.2 - Arbitrary File Upload ''' Updated Exploit Provided by Drew Griess Exploit Title HelpDeskZ = v1.0.2 - Unauthenticated Shell Upload Google Dork intextHelp Desk Software by HelpDeskZ Date 2016-08-26 Exploit Author Lars Morgenroth - @krankoPwnz Vendor Homepage httpwww.helpdeskz.com...
DEBIAN-CVE-2016-6232
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ dot dot slash in a filename in an archive file, related to KNewsstuff downloads...
CVE-2016-6250
A vulnerability was found in libarchive. An attempt to create an ISO9660 volume with 2GB or 4GB filenames could cause the application to crash...
FortiManager and FortiAnalyzer Persistent XSS vulnerability
When a low privileged user uploads images in the report section, the filenames are not properly sanitized; this potentially enables stored XSS attacks...
PT-2016-3037
Name of the Vulnerable Software and Affected Versions ОВЕН ПЛК110 affected versions not specified Description The issue is related to the lack of restrictions on the length of file names that can be written. This could allow a remote attacker to save files in the file system that cannot be delete...
Trihedral VTScada Filter Bypass Information Disclosure Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trihedral VTScada. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Wireless Application Protocol requests. The issue lies in the failur...
Debian Security Advisory DSA 3591-1 (imagemagick - security update)
Bob Friesenhahn from the GraphicsMagick project discovered a command injection vulnerability in ImageMagick, a program suite for image manipulation. An attacker with control on input image or the input filename can execute arbitrary commands with the privileges of the user running the application...
CVE-2016-4072
The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the pharanalyzepath function in ext/phar/phar.c...
Security fix for the ALT Linux 7 package ImageMagick version 6.8.4.10-alt3.M70P.1
6.8.4.10-alt3.M70P.1 built May 20, 2016 Andrey Cherepanov in task 164801 May 18, 2016 Andrey Cherepanov - Apply security patches from Debian: ImageTragick: The coders EPHEMERAL, URL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT are disabled via policy.xml file, since they are vulnerable to code...
Debian DSA-3580-1 : imagemagick - security update (ImageTragick)
Nikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation. These vulnerabilities, collectively known as ImageTragick, are the consequence of lack of sanitization of untrusted input. An attacker with contro...
Gentoo Security Advisory GLSA 201605-01
Gentoo Linux Local Security Checks GLSA 201605-01 SPDX-FileCopyrightText: 2016 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...
WebSVN cross-site scripting vulnerability (CNVD-2016-02878)
WebSVN is a set of Web-based Subversion Repository browser. A cross-site scripting vulnerability in WebSVN's handling of directory names or filenames allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...
GLSA-201605-01 : Git: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201605-01 Git: Multiple vulnerabilities Git is vulnerable to the remote execution of arbitrary code by cloning repositories with large filenames or a large number of nested trees. Additionally, some protocols within Git, such as...
Git: Multiple vulnerabilities
Background Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Description Git is vulnerable to the remote execution of arbitrary code by cloning repositories with large filenames or a large...
SUSE-SU-2016:1177-1 Security update for ntp
ntp was updated to version 4.2.8p6 to fix 12 security issues. Also yast2-ntp-client was updated to match some sntp syntax changes. bsc937837 These security issues were fixed: - CVE-2015-8158: Fixed potential infinite loop in ntpq bsc962966. - CVE-2015-8138: Zero Origin Timestamp Bypass bsc963002....
PHP PHAR Extension Denial of Service Vulnerability (CNVD-2016-02701)
PHP is an open source general-purpose computer scripting language. A security vulnerability exists in the PHP PHAR extension that stems from the program's failure to properly handle filenames in archives, allowing remote attackers to exploit the vulnerability by submitting a special request to...
DEBIAN-CVE-2016-2324
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a 1 long filename or 2 many nested trees, which triggers a heap-based buffer overflow...
DEBIAN-CVE-2016-2315
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a 1 long filename or 2 many nested trees, leading to a heap-based buffer overflow...