postgresql: Start scripts permit database administrator to modify root-owned files

Privilege escalation flaws were found in the initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine...

UBUNTU-CVE-2017-14179

Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers...

UBUNTU-CVE-2017-14180

Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges, a different vulnerability tha...

CVE-2017-9079

Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorizedkeys file format with a command= option. This occurs because /.ssh/authorizedkeys is read with root privileges and symlinks are followed...

Techno Project Japan Enisys Gw Security Bypass Vulnerability

Techno Project Japan Enisys Gw is an open source groupware software from Techno Project Japan. A security vulnerability exists in Techno Project Japan Enisys Gw that can be exploited by remote attackers to bypass security restrictions and read arbitrary web ROOT files...

F5 BIG-IP Directory Traversal Vulnerability

F5 BIG-IP products provide organizations with integrated application delivery services such as acceleration, security, access control and high availability. A directory traversal vulnerability exists in the configuration program of F5 BIG-IP versions prior to 12.0.0, Enterprise Manager versions...

PT-2015-6396

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 12.0.0 Enterprise Manager versions 3.0.0 through 3.1.1 Description A directory traversal issue exists in the configuration utility, allowing remote authenticated users to access arbitrary files in the web root...

Directory traversal

Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262...

SunOS <= 4.1.1 /usr/release/bin/winstall Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22/info This applies to sites that have installed Sun Source tapes only. The Sun distribution of sources sunsrc has an installation procedure which creates the directory /usr/release/bin and installs two setuid root files...

AIX ftp vulnerability

IBM SECURITY ADVISORY First Issued: Thu Oct 18 09:50:27 CDT 2012 The most recent version of this document is available here: | Updated: Fri Feb 8 11:58:57 CDT 2013 | Update: Updated Sections I and V: Description and Workaround | Update: New ifixes for latest SP's | Updated: Thu Dec 12 12:55:11 CS...

Solaris 10 Patch Cluster Symlink Attack

Larry W. Cashdollar 8/6/2012 Here is another symlink attack with temp file creation using process id in Solaris 10 patch cluster. You can over write the contents of root owned files with the contents of inetd.conf. In patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade lines : 72...

Solaris nfslogd Unsafe Use Of Temporary Files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Below is the full disclosure information for CVE-2010-2383. It was reported to [email protected] on 29 December, 2009 and assigned Sun bug 6913655. This vulnerability was addressed by Sun/Oracle in the July 2010 Critical Patch Update...

CVE-2010-2383: Solaris nfslogd unsafe use of temporary files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Below is the full disclosure information for CVE-2010-2383. It was reported to [email protected] on 29 December, 2009 and assigned Sun bug 6913655. This vulnerability was addressed by Sun/Oracle in the July 2010 Critical Patch Update...

CVE-2005-1151

qpopper 4.0.5 and earlier does not properly drop privileges before processing certain user-supplied files, which allows local users to overwrite or create arbitrary files as root...

mformat privilege escalation

It's possible to access any file for reading and create world-writable root-owned files...

BRU 17.0 - XBRU Insecure Temporary File

source: https://www.securityfocus.com/bid/5708/info BRU is a backup and restore utility distributed by The Tolis Group. This problem affects the utility on the Linux platform. xbru does not properly check for the existence of temporary files prior to execution. Because of this, it is possible for...

CVE-2001-0403

Solaris: The /opt/JSparm/bin/perfmon program is affected. Local users can leverage the GUI’s Logging File option to create arbitrary files with root privileges. The vulnerability description and impact are drawn from CVE-2001-0403/NVD entries, which specify local root impact (C/C/I/A = high). No ...

catman-race.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Solaris 2.7/2.8 catman temp file vulnerability. Larry W. Cashdollar Vapid Labs Date Published: 12/18/2000 Advisory ID: 11242000-02 Risk: Low Title: catman temp file vulnerability. Class: Design Error Remotely Exploitable: no Locally Exploitable: Yes...

LPPlus 3.2.23.3 - Permissions Denial of Service

LPPlus 3.2.23.3 - Permissions Denial of Service source: https://www.securityfocus.com/bid/1643/info Vulnerability 1: Several files that are part of the LPPlus print management system are installed setuid root by default. These files include: $LPHOME/bin/dccsched $LPHOME/bin/dcclpdser...

LPPlus 3.2.2/3.3 - Permissions Denial of Service

source: https://www.securityfocus.com/bid/1643/info Vulnerability 1: Several files that are part of the LPPlus print management system are installed setuid root by default. These files include: $LPHOME/bin/dccsched $LPHOME/bin/dcclpdser $LPHOME/bin/dccbkst These start the scheduler, LPD server an...