Scientific Linux Security Update : tar on SL5.x, SL4.x i386/x86_64

A path traversal flaw was discovered in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar had write access. CVE-2007-4131 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text i...

CVE-2012-3360: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute Nova Folsom 2012.2 and Essex 2012.1, when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. dot dot in the path attribute of a file element...

HP OpenView Performance Manager PMParamHandler Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP OpenView Performance Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PMParamHandler component of Performance Manager, which is served v...

Galette <=0.63.3 picture.class.php文件任意文件写入漏洞

No description provided by source...

CVE-2010-5102: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in mod/tools/em/class.emunzip.php in the unzip library in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote attackers to write arbitrary files via unspecified vectors...

FreeBSD : puppet -- Multiple Vulnerabilities (607d2108-a0e4-423a-bf78-846f2a8f01b0)

Multiple vulnerabilities exist in puppet that can result in arbitrary code execution, arbitrary file read access, denial of service, and arbitrary file write access. Please review the details in each of the CVEs for additional information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

[Onapsis Security Advisory 2012-01] Oracle JD Edwards JDENET Arbitrary File Write

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Onapsis Security Advisory: Oracle JD Edwards JDENET Arbitrary File Write This advisory can be downloaded in PDF format from http://www.onapsis.com/. By downloading this advisory from the Onapsis Resource Center, you will gain access to beforehand...

CVE-2012-0907: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the web player in NeoAxis NeoAxis web player 1.4 and earlier allows user-assisted remote attackers to write arbitrary files via a .. dot dot in a filename in the neoaxiswebapplicationwin32.zip ZIP archive...

CVE-2011-4800: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" dot dot colon forward slash in the 1 list, 2 put, or 3 get commands...

EPractize Labs Backdoor

Vulnerability: back door in stupid spamming software About EPractize Labs: EPractize Labs is fully Customer Focused, Innovative and Global service provider for Skill Development and Skill Evaluation products suitable for pre employment assessment testing, employee evaluation for appraisal,...

CVE-2011-3204: Improper Link Resolution Before File Access

hammerhead.cc in Hammerhead 2.1.4 allows local users to write to arbitrary files via a symlink attack on 1 /tmp/hammer.log aka the HHLOG file or 2 the REPORTLOG file...

CVE-2011-3007: Improper Control of Generation of Code

The myCIOScn ActiveX control myCIOScn.dll in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log file and executing...

ZyWALL USG Appliance Arbitrary File Read / Write

Advisory: Authentication Bypass in Configuration Import and Export of ZyXEL ZyWALL USG Appliances Unauthenticated users with access to the management web interface of certain ZyXEL ZyWALL USG appliances can download and upload configuration files, that are applied automatically. Details =======...

CVE-2010-4790: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in FilterFTP 2.0.3, 2.0.5, and probably earlier versions, allows remote FTP servers to write arbitrary files via a ".." dot dot backslash in a filename. NOTE: some of these details are obtained from third party information...

CVE-2011-1565: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System IGSS allows remote attackers to 1 read opcode 0x3 or 2 create or write opcode 0x2 arbitrary files via ..\ dot dot backslash sequences to TCP port 12401...

DEBIAN-CVE-2010-4651

Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. dot dot or full pathname, a related issue to CVE-2010-1679...

CVE-2010-4154: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Rhino Software, Inc. FTP Voyager 15.2.0.11, and possibly earlier, allows remote FTP servers to write arbitrary files via a ".." dot dot backslash in a filename...

CVE-2010-4153: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in CrossFTP Pro 1.65a, and probably earlier, allows remote FTP servers to write arbitrary files via a ".." dot dot backslash in a filename...

CVE-2010-4148: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in AnyConnect 1.2.3.0, and possibly earlier, allows remote FTP servers to write arbitrary files via a ".." dot dot backslash in a filename...

CVE-2010-4149: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in FreshWebMaster Fresh FTP 5.36, 5.37, and possibly earlier, allows remote FTP servers to write arbitrary files via a ".." dot dot backslash in a filename. NOTE: some of these details are obtained from third party information...