[Full-Disclosure] Arbitrary files overwriting through skins in DivX Player 2.6

Luigi Auriemma Application: DivX Player http://www.divx.com/divx/player/ Versions: = 2.6 Platforms: Windows Bug: arbitrary files overwriting through skins Exploitation: local or remote through browser Date: 21 Jan 2005 Author: Luigi Auriemma e-mail: [email protected] web:...

CVE-2005-1846

Multiple directory traversal vulnerabilities in YaMT before 0.52 allow attackers to overwrite arbitrary files via the 1 rename or 2 sort options...

tnftp: Arbitrary file overwriting

Background tnftp is a NetBSD FTP client with several advanced features. Description The 'mget' function in cmds.c lacks validation of the filenames that are supplied by the server. Impact An attacker running an FTP server could supply clients with malicious filenames, potentially allowing the...

DSA-624-1 zip - buffer overflow

Bulletin has no description...

mod_dosevasive -- insecure temporary file creation

An LSS Security Advisory reports: When a denial of service attack is detected, moddosevasive will, among other things, create a temporary file which it will use to trace actions from the offensive IP address. This file is insecurely created in /tmp and it's name is easily predictable. It is then...

CVE-2004-2643

Directory traversal vulnerability in Microsoft cabarc allows remote attackers to overwrite files via "../" sequences in file names in a CAB archive...

a2ps -- insecure temporary file creation

A Secunia Security Advisory reports that Javier Fernández-Sanguino Peña has found temporary file creation vulnerabilities in the fixps and psmandup scripts which are part of a2ps. These vulnerabilities could lead to an attacker overwriting arbitrary files with the credentials of the user running...

[SECURITY] [DSA 615-1] New debmake package fixes insecure temporary directories

-------------------------------------------------------------------------- Debian Security Advisory DSA 615-1 [email protected] http://www.debian.org/security/ Martin Schulze December 22nd, 2004 http://www.debian.org/security/faq -...

DSA-615-1 debmake - insecure temporary file

Bulletin has no description...

Opera 7 multiple bugs

Crossite scripting including local zone, local files access, mail access, user activity tracking, etc. Buffer overflow. Directory traversal. Files overwriting. Local files access with Location overwriting. Multiple Java bugs...

GNU Wget 1.x - Multiple Vulnerabilities

GNU Wget 1.x - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/11871/info Multiple remote vulnerabilities reportedly affect GNU wget. These issues are due to the application's failure to properly sanitize user-supplied input and to properly validate the presence of files before...

GNU Wget 1.x - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/11871/info Multiple remote vulnerabilities reportedly affect GNU wget. These issues are due to the application's failure to properly sanitize user-supplied input and to properly validate the presence of files before writing to them. The issues include: - ...

GLSA-200412-05 : mirrorselect: Insecure temporary file creation

The remote host is affected by the vulnerability described in GLSA-200412-05 mirrorselect: Insecure temporary file creation Ervin Nemeth discovered that mirrorselect creates temporary files in world-writable directories with predictable names. Impact : A local attacker could create symbolic links...

CVE-2004-1027

Directory traversal vulnerability in the -x extract command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. dot dot sequences...

CVE-2004-1027

Directory traversal vulnerability in the -x extract command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. dot dot sequences...

OpenSSL, Groff: Insecure tempfile handling

Background OpenSSL is a toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols as well as a general-purpose cryptography library. It includes the derchop script, which is used to convert DER-encoded certificates to PEM format. Groff GNU Troff is a typesetting package...

Mandrake Linux Security Advisory : netatalk (MDKSA-2004:121)

The etc2ps.sh script, part of the netatalk package, creates files in /tmp with predicatable names which could allow a local attacker to use symbolic links to point to a valid file on the filesystem which could lead to the overwriting of arbitrary files if etc2ps.sh is executed by someone with...

GLSA-200410-25 : Netatalk: Insecure tempfile handling in etc2ps.sh

The remote host is affected by the vulnerability described in GLSA-200410-25 Netatalk: Insecure tempfile handling in etc2ps.sh The etc2ps.sh script creates temporary files in world-writeable directories with predictable names. Impact : A local attacker could create symbolic links in the temporary...

security flaw

The mysqlhotcopy script in mysql 4.0.20 and earlier, when using the scp method from the mysql-server package, allows local users to overwrite arbitrary files via a symlink attack on temporary files...

ghostscript -- insecure temporary file creation vulnerability

Ghostscript is affected by an insecure temporary file creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the existence of a file before writing to it. An attacker may leverage this issue to overwrite arbitrary files with the privileges...