PT-2013-3843

Name of the Vulnerable Software and Affected Versions OpenFabrics ibutils version 1.5.7 Description The issue allows local users to overwrite arbitrary files via a symlink attack on several files in /tmp/, including ibdiagnet.db, ibdiagnet.fdbs, ibdiagnet ibis.log, ibdiagnet.log, ibdiagnet.lst,...

PT-2013-1513

Name of the Vulnerable Software and Affected Versions Augeas versions prior to 1.0.0 Description The issue allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file. This is due to a problem in the transform save function in transform....

PT-2013-4998

Name of the Vulnerable Software and Affected Versions libvirt versions 1.1.2 through 1.1.3 Description The issue allows local users to overwrite arbitrary files and possibly gain privileges via unspecified environment variables or command-line arguments. Recommendations For libvirt versions 1.1.2...

PT-2013-5757

Name of the Vulnerable Software and Affected Versions Metaclassy Byword app versions 2.0 through 2.1 Description The issue allows remote attackers to overwrite arbitrary files. This is achieved via the name and text parameters in a "byword://replace" URL, as the app does not require confirmation ...

CVE-2013-1444

A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222...

PT-2013-3140

Name of the Vulnerable Software and Affected Versions txt2man versions 1.5.5-2 through 1.5.5-4 Description The issue allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222. Recommendations For versions 1.5.5-2 through 1.5.5-4, consider restricting access to the /tmp...

CVE-2013-1444: Improper Link Resolution Before File Access

A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222...

PT-2013-3525

Name of the Vulnerable Software and Affected Versions Red Hat CloudForms Management Engine version 2.0 Description The issue concerns multiple directory traversal vulnerabilities in the AgentController. Remote attackers can exploit this to create and overwrite arbitrary files by including a .. do...

CVE-2013-4277

Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option...

CVE-2013-4260

lib/ansible/playbook/init.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/...

CVE-2013-4260: Undefined Security Weakness

lib/ansible/playbook/init.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/...

CVE-2013-5648

Absolute path traversal vulnerability in the handleStartDataFile function in DigiDocSAXParser.c in libdigidoc 3.6.0.0, as used in ID-software before 3.7.2 and other products, allows remote attackers to overwrite arbitrary files via a filename beginning with / slash or \ backslash in a DDOC file...

CVE-2013-5648

Absolute path traversal vulnerability in the handleStartDataFile function in DigiDocSAXParser.c in libdigidoc 3.6.0.0, as used in ID-software before 3.7.2 and other products, allows remote attackers to overwrite arbitrary files via a filename beginning with / slash or \ backslash in a DDOC file...

CVE-2013-3598: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in servlet/CreateTemplateServlet in SearchBlox before 7.5 build 1 allows remote attackers to overwrite arbitrary files via a .. dot dot in the name parameter...

PT-2013-4326

Name of the Vulnerable Software and Affected Versions Request Tracker RT versions 3.8.x through 3.8.16 Request Tracker RT versions 4.0.x through 4.0.12 Description The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name. This is...

CVE-2013-1888

pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory...

PT-2013-3451

Name of the Vulnerable Software and Affected Versions pip versions prior to 1.3 Description The issue allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory. Recommendations For versions prior to 1.3, update to version 1.3 or later...

CVE-2013-3005: Undefined Security Weakness

The TFTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, when RBAC is enabled, allows remote authenticated users to bypass intended file-ownership restrictions, and read or overwrite arbitrary files, via unspecified vectors...

PT-2013-4089

Name of the Vulnerable Software and Affected Versions IBM AIX versions 6.1 and 7.1 VIOS version 2.2.2.2-FP-26 SP-02 Description The issue allows remote authenticated users to bypass intended file-ownership restrictions and read or overwrite arbitrary files when RBAC is enabled. Recommendations Fo...

PT-2013-2100

Name of the Vulnerable Software and Affected Versions Microsoft Windows Essentials versions 2011 through 2012 Description The issue allows remote attackers to bypass proxy settings and overwrite arbitrary files via crafted URL parameters. Recommendations For Microsoft Windows Essentials versions...