Directory Traversal

Overview Affected versions of sencisho are vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL. Example request: GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:foo Recommendation No patch is available for this...

Directory Traversal

Overview Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL. Proof of Concept GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:localhost Recommendation No patch is currently available for this vulnerability, a...

Design/Logic Flaw

lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat family of syscalls...

CVE-2016-8649: Undefined Security Weakness

lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat family of syscalls...

Apache Batik XXE Information Disclosure Vulnerability

Apache Batik is a pure Java library for rendering, generating and manipulating SVG graphics. An information disclosure vulnerability exists in Apache Batik XXE. In Apache Batik, files located on the file system of a server using batik can be disclosed to an arbitrary user who sends a maliciously...

WordPress Plugin Wow Viral Signups 2.1 - SQL Injection

WordPress Plugin Wow Viral Signups 2.1 - SQL Injection Exploit Title: Wow Viral Signups v2.1 WordPress Plugin SQL Injection Date: 29/03/2017 Exploit Author: TAD GROUP Vendor Homepage: http://wow-company.com/ Software Link: https://wordpress.org/plugins/mwp-viral-signup/ Version: 2.1 Contact:...

WordPress Plugin Wow Viral Signups 2.1 - SQL Injection

Exploit Title: Wow Viral Signups v2.1 WordPress Plugin SQL Injection Date: 29/03/2017 Exploit Author: TAD GROUP Vendor Homepage: http://wow-company.com/ Software Link: https://wordpress.org/plugins/mwp-viral-signup/ Version: 2.1 Contact: infoattad.group Website: https://tad.group Category: Web...

CVE-2017-7418: Improper Link Resolution Before File Access

ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass th...

Oracle VM VirtualBox - Cooperating VMs can Escape from Shared Folder

Oracle VM VirtualBox - Cooperating VMs can Escape from Shared Folder Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1037 There is a security issue in the shared folder implementation that permits cooperating guests with write access to the same shared folder to gain access to t...

CVE-2017-5219

CVE-2017-5219 affects SageCRM 7.x prior to 7.3 SP3. The Component Manager allows uploading a zip containing a valid .ecf component file, which is extracted to the inf directory outside the webroot. A crafted zip with an empty .ecf can cause arbitrary files to be extracted, including a web shell n...

[ASA-201702-2] qt5-webengine: multiple issues

Arch Linux Security Advisory ASA-201702-2 ========================================= Severity: High Date : 2017-02-02 CVE-ID : CVE-2016-5182 CVE-2016-5183 CVE-2016-5189 CVE-2016-5199 CVE-2016-5201 CVE-2016-5203 CVE-2016-5204 CVE-2016-5205 CVE-2016-5206 CVE-2016-5207 CVE-2016-5208 CVE-2016-5210...

[ASA-201612-3] chromium: multiple issues

Arch Linux Security Advisory ASA-201612-3 ========================================= Severity: Critical Date : 2016-12-03 CVE-ID : CVE-2016-5203 CVE-2016-5204 CVE-2016-5205 CVE-2016-5206 CVE-2016-5207 CVE-2016-5208 CVE-2016-5209 CVE-2016-5210 CVE-2016-5211 CVE-2016-5212 CVE-2016-5213 CVE-2016-5214...

wget security and bug fix update

1.14-13 - Fix CVE-2016-4971 1345778 - Added support for non-ASCII URLs Related: CVE-2016-4971 1.14-12 - Fix wget to include Host header on CONNECT as required by HTTP 1.1 1203384 - Run internal test suite during build 1295846 - Fix -nv being documented as synonym for two options 1147572 1.14-11 -...

PT-2016-7599

Name of the Vulnerable Software and Affected Versions Docker Engine version 1.12.2 Description The issue allows malicious images to bypass user permissions and access files within the container filesystem or mounted volumes due to misconfigured capability policies. Recommendations For Docker Engi...

CVE-2016-8867: Undefined Security Weakness

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

RSA Enterprise Compromise Assessment Tool (ECAT) 4.1.0.1 XXE Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XML External Entity Injection XXE product: RSA Enterprise Compromise Assessment Tool ECAT vulnerable version: 4.1.0.1 fixed version: 4.1.2.0 CVE Number: - impact: Medium...

RSA Enterprise Compromise Assessment Tool 4.1.0.1 - XML External Entity Injection

RSA Enterprise Compromise Assessment Tool 4.1.0.1 - XML External Entity Injection SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XML External Entity Injection XXE product: RSA Enterprise Compromise Assessment Tool ECA...

RSA Enterprise Compromise Assessment Tool 4.1.0.1 - XML External Entity Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XML External Entity Injection XXE product: RSA Enterprise Compromise Assessment Tool ECAT vulnerable version: 4.1.0.1 fixed version: 4.1.2.0 CVE Number: - impact: Medium...

SUSE-SU-2016:2404-1 Security update for mariadb

This update for mariadb to 1.0.0.27 fixes the following issues: Security issue fixed: CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and, under certain circumstances, execute arbitrary code as mysql or even root user. bsc998309 release notes:...

webkit2gtk: multiple issues

CVE-2016-4590 same-origin policy bypass xisigr of Tencents Xuanwu Lab discovered a vulnerability in the way webkit handles URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. - CVE-2016-4591 arbitrary filesystem access ma.la of LINE Corporation discoveered...