112 matches found
CVE-2019-4395
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary script files. IBM X-Force ID: 162333...
Security Bulletin: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition is affected by ASoC vulnerability (CVE-2019-4395)
Summary IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise has addressed the ASoC vulnerability. Vulnerability Details CVEID: CVE-2019-4395 DESCRIPTION: IBM Cloud Orchestrator could allow a local user to obtain sensitive information from temporary script files. CVSS Base Score: 4 CVSS...
CVE-2019-0327
SAP NetWeaver for Java Application Server - Web Container, engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5, servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5, allows an attacker to upload files including script files without proper file format validation...
Input validation
SAP BusinessObjects, versions 4.2 and 4.3, Visual Difference allows an attacker to upload any file including script files without proper file format validation...
Design/Logic Flaw
An issue was discovered in zsh before 5.6. The beginning of a ! script file was mishandled, potentially leading to an execve call to a program named on the second line...
Input validation
A vulnerability in the Disk Check Tool disk-check.sh for Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges level 15 to log in to the...
Cisco Wide Area Application Services Software Scripts Privilege Escalation Vulnerability
A vulnerability in Cisco-provided scripts disk-check.sh and harcap.sh for Cisco Wide Area Application Services WAAS Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges level 15 to...
SAP Internet Graphics Server Arbitrary File Upload Vulnerability
SAP Internet Graphics Server IGS is a graphics server from SAP, Germany. The product is capable of generating graphs or charts in different areas. A security vulnerability exists in SAP IGS that stems from the program's failure to properly validate file formats. An attacker could exploit the...
CVE-2018-2420
SAP Internet Graphics Server IGS, 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to upload any file including script files without proper file format validation...
Quant Loader Trojan Spreads Via Microsoft URL Shortcut Files
Researchers are warning of a new email phishing campaign that downloads and launches the Quant Loader trojan, capable of distributing ransomware and stealing passwords. Barracuda on Tuesday said it has been tracking emails containing zipped Microsoft internet shortcut files with a “.url” file...
Cisco Application Policy Infrastructure Controller Local Command Injection and Privilege Escalation Vulnerability
A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructure Controllers could allow an authenticated, local attacker to gain elevated privileges and execute arbitrary commands with root privileges on an affected host operating system...
ZYCHCMS V06 Build170526 has a file inclusion vulnerability
ZYCHCMS is an enterprise website management system. A file inclusion vulnerability exists in ZYCHCMS V06. An attacker can exploit this vulnerability to upload script files...
Cisco Policy Suite Elevation of Privilege Vulnerability
Cisco Policy Suite is the management policy suite. An elevation of privilege vulnerability exists in certain script files in Cisco Policy Suite CPS Software, which can be exploited by a local attacker to elevate privileges to root...
Firmware File System Extraction: firmwalker
A simple bash script for searching the extracted or mounted firmware file system. It will search through the extracted or mounted firmware file system for things of interest such as: etc/shadow and etc/passwd list out the etc/ssl directory search for SSL related files such as .pem, .crt, etc...
Cisco Headend System Release Sensitive Information Disclosure Vulnerability
The Cisco Headend System Release is a front-end broadband digital transmission system. A security vulnerability exists in the Cisco Headend System Release that could allow a remote attacker to submit a specially crafted HTTP request to read a temporary script file or archive to obtain sensitive...
Microsoft Internet Explorer 5.5/6.0 Spoofable File Extensions Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3597/info It is possible for a malicious webmaster, hosting files on an website, to spoof file extensions for users of Internet Explorer. For example, an .exe file can be made to look like a .txt or other seemingly harmle...
Yaws 1.5x Remote Source Code Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13981/info A vulnerability has been reported in Yaws that may result in the disclosure of script files' source code. Information obtained in this manner may be used by the attacker to launch further attacks against a...
Directory traversal
Directory traversal vulnerability in the CLI parser in Cisco NX-OS allows local users to create arbitrary script files via a relative pathname in the "file name" parameter, aka Bug IDs CSCua71557 and CSCua71551...
CVE-2012-4141
Directory traversal vulnerability in the CLI parser in Cisco NX-OS allows local users to create arbitrary script files via a relative pathname in the "file name" parameter, aka Bug IDs CSCua71557 and CSCua71551...
