UBUNTU-CVE-2016-2315

revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a 1 long filename or 2 many nested trees, leading to a heap-based buffer overflow...

openSUSE Security Update : gummi (openSUSE-2016-266)

This update for gummi fixes the following issues : - CVE-2015-7758: predictable filenames in /tmp based on basename - use final upstream patch boo949682 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Securit...

USN-2906-1 cpio vulnerabilities

Alexander Cherepanov discovered that GNU cpio incorrectly handled symbolic links when used with the --no-absolute-filenames option. If a user or automated system were tricked into extracting a specially-crafted cpio archive, a remote attacker could possibly use this issue to write arbitrary files...

Ubuntu: Security Advisory (USN-2879-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2879-1 rsync vulnerability

It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this issue to write files outside of the intended destination directory...

USN-2879-1: rsync vulnerability

It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this issue to write files outside of the intended destination directory...

CVE-2015-6383

Cisco IOS XE 15.43S on ASR 1000 devices improperly loads software packages, which allows local users to bypass license restrictions and obtain certain root privileges by using the CLI to enter crafted filenames, aka Bug ID CSCuv93130...

SUSE SLED12 / SLES12 Security Update : dracut (SUSE-SU-2015:2065-1)

The dracut package was updated to fix the following security and non-security issues : - CVE-2015-0794: Use mktemp instead of hard-coded filenames, possible vulnerability bsc935338. - Always install mdraid modules bsc935993. - Add notice when dracut failed to install modules bsc952491. - Always...

openSUSE Security Update : dracut (openSUSE-2015-765)

The dracut package was updated to fix the following security and non security issues : - CVE-2015-0794: Use mktemp instead of hardcoded filenames, possible vulnerability bnc935338. - Always install mdraid modules boo935993. - Add notice when dracut failed to install modules bsc952491. %NASLMINLEV...

CVE-2004-0996

main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack...

SUSE: Security Advisory for ppc64-diag (SUSE-SU-2014:0928-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-4037: Undefined Security Weakness

The slirpsmb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service instantiation failure by creating /tmp/qemu-smb.- files before the program...

Updated owncloud package fixes security vulnerabilities

In ownCloud before 6.0.8 and 8.0.4, a bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted CVE-2015-4715. In ownCloud before 6.0.8 and 8.0.4, the...

php: regressions in 5.4+

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions...

CVE-2015-4336

cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file...

WordPress Xcloner Plugin and Joomla! Xcloner Plugin Execute Arbitrary Code Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language . Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. XCloner is one of the plug-ins used to back up and restore data and...

CVE-2014-8605: Undefined Security Weakness

The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/...

Brandon Bowles Open Explorer application directory traversal vulnerability

Brandon Bowles Open Explorer application for Android is a resource management application for Android. A directory traversal vulnerability exists in Brandon Bowles Open Explorer application for Android version 0.254, which allows remote attackers to write arbitrary files using specially crafted...

Piriform CCleaner Wiped Filename Recovery

Vulnerability Details Affected Vendor: Piriform Affected Product: CCleaner Affected Version: 3.26.0.1988 - 5.02.5101 Platform: Microsoft Windows 7 x64 Service Pack 1 CWE Classification: CWE-200: Information Exposure Impact: Information Exposure Attack vector: Local CVE-ID: CVE-2015-3999 2...

ManageEngine Desktop Central MSP InventoryServlet computer File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the InventoryServlet servlet. The issue lies in the failure to saniti...