FreeBSD : pear-twig -- remote code execution (705b759c-7293-11e5-a371-14dae9d210b8)

Fabien Potencier reports : End users can craft valid Twig code that allows them to execute arbitrary code RCEs via the self variable, which is always available, even in sandboxed templates. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Oracle: Security Advisory (ELSA-2011-1741)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PEAR XML_RPC 1.3.0 - Remote Code Execution

PEAR XMLRPC 1.3.0 - Remote Code Execution PEAR XMLRPC Remote Code Execution Vendor: The PEAR Group Product: PEAR XMLRPC Version: = 1.3.0 Website: http://pear.php.net/package/XMLRPC/ CVE: 17793 PACKETSTORM: 38393 Description: PEAR XMLRPC is a PHP implementation of the XML-RPC web RPC protocol, and...

Moderate: Red Hat Security Advisory: php55 security and bug fix update

Updated php55 collection packages that fix multiple security issues and several bugs are now available as part of Red Hat Software Collections 2. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

LupperA XMLRPC Propagation Request Code Execution - Ver2 (CVE-2005-1921)

A code execution vulnerability has been reported in Pear XML RPC. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

GLSA-201412-09 : Multiple packages, Multiple vulnerabilities fixed in 2011

The remote host is affected by the vulnerability described in GLSA-201412-09 Multiple packages, Multiple vulnerabilities fixed in 2011 Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details. FMOD Studio PEAR Mail...

Multiple packages, Multiple vulnerabilities fixed in 2011

Background For more information on the packages listed in this GLSA, please see their homepage referenced in the ebuild. Description Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details. FMOD Studio PEAR Mail LVM...

MGASA-2014-0519 Updated php-pear-HTML_AJAX package fixes security vulnerability

Updated php-pear-HTMLAJAX package fixes security vulnerability: The HTMLAJAX pear module before version 0.5.7 is vulnerable to a bug that can allow for remote code execution through unspecified vectors...

PT-2014-9146

Name of the Vulnerable Software and Affected Versions php-pear-HTML AJAX versions prior to 0.5.7 Description The issue allows for remote code execution through unspecified vectors. Recommendations For versions prior to 0.5.7, update to version 0.5.7 or later to resolve the issue...

Design/Logic Flaw

The PEARREST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a 1 rest.cachefile or 2 rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions...

CVE-2014-5459

The PEARREST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a 1 rest.cachefile or 2 rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions...

UBUNTU-CVE-2014-5459

The PEARREST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a 1 rest.cachefile or 2 rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions...

CVE-2014-5459

CVE-2014-5459 affects the PEAR REST class (REST.php) in PEAR for PHP up to 5.6.0. The vulnerability arises from insecure temporary files created in /tmp/pear/cache (rest.cachefile and rest.cacheid) used by retrieveCacheFirst and useLocalCache, enabling a local attacker to write to arbitrary files...

CVE-2014-5459

The PEARREST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a 1 rest.cachefile or 2 rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions...

PT-2014-6489

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.0 PEAR affected versions not specified Description The issue allows local users to write to arbitrary files via a symlink attack on a rest.cachefile or rest.cacheid file in /tmp/pear/cache. This is related to the...

CVE-2014-5459: Improper Link Resolution Before File Access

The PEARREST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a 1 rest.cachefile or 2 rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions...

PHP PEAR <= 1.5.3 INSTALL-AS Attribute Arbitrary File Overwrite Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24111/info PEAR is prone to a vulnerability that lets attackers overwrite arbitrary files. An attacker-supplied package may supply directory-traversal strings through the 'install-as' attribute to create and overwrite fil...

V-webmail 1.6.4 includes/pear/Log.php CONFIG[pear_dir] Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/30162/info V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues can allow an attacker to compromise the application and t...

PEAR 1.9.0 - Multiple Remote File Inclusion Vulnerability

No description provided by source. PEAR v.1.9.0 Multiple Remote File Inclusion Vulnerability PEAR, the PHP Extension and Application Repository @package PEAR @Version v.1.9.0 @license http://opensource.org/licenses/bsd-license.php New BSD License @link http://pear.php.net/package/PEAR Type : Remo...

Roundcube Webmail 0.8.0 - Stored XSS

No description provided by source. !/usr/bin/python ''' Exploit Title: Roundcube Webmail Stored XSS. Date: 14/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://roundcube.net Software Link:...