SAP NetWeaver Java 7.5 XXE

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.5 Vendor URL: SAP Bugs: XXE Reported: 17.06.2016 Vendor response: 18.06.2016 Date of Public Advisory: 10.01.2017 Reference: SAP Security Note 2347439 Author: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class: XXE Impact: Denial of...

upnp -- multiple vulnerabilities

Matthew Garett reports: Reported this to upstream 8 months ago without response, so: libupnp's default behaviour allows anyone to write to your filesystem. Seriously. Find a device running a libupnp based server Shodan says there's rather a lot, and POST a file to /testfile. Then GET /testfile...

[SECURITY] [DLA 424-1] didiwiki security update

Package : didiwiki Version : 0.5-9+deb6u1 CVE ID : CVE-2013-7448 Debian Bug : 815111 Alexander Izmailov discovered that didiwiki, a wiki implementation, failed to correctly validate user-supplied input, thus allowing a malicious user to access any part of the filesystem...

DLA-424-1 didiwiki - security update

Bulletin has no description...

[SECURITY] [DSA 3485-1] didiwiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3485-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 20, 2016 https://www.debian.org/security/faq -...

DSA-3485-1 didiwiki - security update

Bulletin has no description...

Debian Security Advisory DSA 3485-1 (didiwiki - security update)

Alexander Izmailov discovered that didiwiki, a wiki implementation, failed to correctly validate user-supplied input, thus allowing a malicious user to access any part of the filesystem. OpenVAS Vulnerability Test $Id: deb3485.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory...

Debian: Security Advisory (DSA-3485-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Remote Code Execution Vulnerabilities (3105864)

This host is missing a critical security update according to Microsoft Bulletin MS15-115. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Debian DLA-325-1 : linux-2.6 security update

This update fixes the CVEs described below. CVE-2015-2925 Jann Horn discovered that when a subdirectory of a filesystem was bind-mounted into a chroot or mount namespace, a user that should be confined to that chroot or namespace could access the whole of that filesystem if they had write...

SUSE: Security Advisory for wget (SUSE-SU-2014:1366-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2014-1764)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Windows operating system allows a perpetrator to circumvent access restrictions to the file system and delete arbitrary files.

The vulnerability of the Windows operating system’s task scheduler is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious individual to circumvent restrictions on access to the file system and delete arbitrary files...

CVE-2015-2484

Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, which allows remote attackers to delete arbitrary files via unspecified vectors, aka "Tampering Vulnerability."...

CVE-2015-5752

Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink...

CVE-2015-5746

AppleFileConduit in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via an afc command that leverages symlink mishandling...

Information disclosure

Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink...

Command injection

AppleFileConduit in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via an afc command that leverages symlink mishandling...

CVE-2015-5752

Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink...

CVE-2015-5752

CVE-2015-5752 (Apple iOS Backup Symbolic Link Vulnerability) Affected software: Apple iOS prior to 8.4.1, specifically the Backup component. Root cause: A symbolic link handling flaw in the backup mechanism allowed a crafted app to create symlinks that bypassed intended filesystem access restrict...