PT-2015-6664

Name of the Vulnerable Software and Affected Versions DevExpress AJAX Control Toolkit versions prior to 15.1 Description The issue allows remote attackers to write to arbitrary files via a .. dot dot in the fileId parameter to "AjaxFileUploadHandler.axd" API endpoint. Recommendations For versions...

Apple OS X DYLD_PRINT_TO_FILE Environment Variable Checksum Local ROOT Privilege Gain Vulnerability

Apple Mac OS X is an operating system developed by Apple Inc. Apple Mac OS X fails to properly calibrate the DYLDPRINTTOFILE environment variable, allowing local attackers to write arbitrary files with root privileges and elevated privileges...

Mac OS X : Cisco AnyConnect Secure Mobility Client < 3.1.10010.0 / 4.0.x < 4.0.4013.0 / 4.1.x < 4.1.4011.0 IPC File Write Vulnerability

The Cisco AnyConnect Secure Mobility Client installed on the remote Mac OS X host is a version prior to 3.1.10010.0, or is version 4.0.x prior to 4.0.4013.0, or version 4.1.x prior to 4.1.4011.0. It is, therefore, affected by a flaw that allows unauthenticated IPC commands to write files. A local...

Symantec Endpoint Protection Manager Arbitrary File Write Vulnerability

Symantec Endpoint Protection Manager SEPM is a suite of enterprise-grade virus protection software from Symantec USA. The software protects against malicious attacks such as viruses, worms, and Trojan horses. SEPM 12.1-RU6-MP1 A security vulnerability exists in the management console of previous...

PT-2015-5323

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection Manager SEPM versions 12.1 through 12.1 before 12.1-RU6-MP1 Description The issue allows remote authenticated users to write to arbitrary files and obtain administrator privileges via a crafted filename...

CVE-2015-4289: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.02049 allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920...

CVE-2015-1487: Improper Input Validation

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote authenticated users to write to arbitrary files, and consequently obtain administrator privileges, via a crafted filename...

Symantec Endpoint Protection Multiple Issues

SUMMARY The management console for Symantec Endpoint Protection Manager SEPM is susceptible to multiple vulnerabilities including SQL Injection, authentication bypass, possible path traversal and the potential for arbitrary file read/write. SEP clients are susceptible to a binary planting...

Child Theme Creator by Orbisius <= 1.2.6 - Arbitrary File Write

The Child Theme Creator by Orbisius WordPress plugin was affected by an Arbitrary File Write security vulnerability...

WordPress Child Theme Creator Plugin <= 1.2.6 - Arbitrary File Write

Because of this vulnerability, remote authenticated users can write arbitrary content to existing files in theme directory. Solution Update this plugin...

CVE-2015-3708: Undefined Security Weakness

kextd in kext tools in Apple OS X before 10.10.4 allows attackers to write to arbitrary files via a crafted app that conducts a symlink attack...

CVE-2015-3202

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking 1 mount or 2 umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNTMTAB environment variable that is used by mount's debugging feature...

CVE-2015-3202: Undefined Security Weakness

fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking 1 mount or 2 umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNTMTAB environment variable that is used by mount's debugging feature...

CVE-2015-1942

The CVE-2015-1942 entry concerns IBM Tivoli Storage Manager FastBack Server. Multiple sources (IBM Security Bulletin, NVD/NIST, and Nessus/OpenVAS listings) confirm that FastBack Server versions up to 6.1.11.1 are affected when handling crafted TCP traffic. The root issue is a remote code executi...

PT-2015-1399

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager FastBack versions prior to 6.1.12 Description The issue allows remote attackers to write to and execute arbitrary files by sending crafted TCP packets to an unspecified port. This is due to insufficient input...

CVE-2015-1942: Improper Input Validation

The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to write to arbitrary files, and subsequently execute these files, via a crafted TCP packet to an unspecified port...

CVE-2015-2966: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Droidware UK Explorer+ File Manager application before 2.3.3 for Android allows remote attackers to write to arbitrary files via unspecified vectors...

CVE-2015-5149: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. dot dot in the component parameter in the Request component to workorder/Attachment.jsp...

advisories

ZipFury: Yet another Zip arbitrary file write with system priv...

PT-2015-6649

Name of the Vulnerable Software and Affected Versions Samsung Galaxy S series affected versions not specified Description The issue allows remote web servers to write to arbitrary files and execute arbitrary code in a privileged context by leveraging control of the skslm.swiftkey.net domain name...