CVE-2018-1315

In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FTP client code in HPL/SQL does not veri...

CVE-2018-1315: Incorrect Permission Assignment for Critical Resource

In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FTP client code in HPL/SQL does not veri...

PT-2018-11631

Name of the Vulnerable Software and Affected Versions Apache Hive versions 2.1.0 through 2.3.2 Description The issue arises when the 'COPY FROM FTP' statement is executed using the HPL/SQL extension to Hive. A malicious FTP server can cause a file to be written to an arbitrary location on the...

Arbitrary File Write

Amendment This was deemed not a vulnerability. Overview org.apache.hive:hive-common is a reading, writing, and managing large datasets residing in distributed storage using SQL. Affected versions of this package are vulnerable to Arbitrary File Write via the File Transfer Protocol FTP client...

Arbitrary File Write

Overview org.apache.hive:hive-hplsql is a data warehouse software facilitates reading, writing, and managing large datasets residing in distributed storage using SQL. Affected versions of this package are vulnerable to Arbitrary File Write via the File Transfer Protocol FTP client functionality...

Cisco IOS XE Software Input Validation Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. An input validation vulnerability exists in the Web UI of Cisco IOS XE Software, which arises from the program's failure to adequately perform input validation on HTTP requests. A remote attacker could exploi...

Homematic CCU2 2.29.23 Arbitrary File Write

!/usr/bin/ruby Exploit Title: Homematic CCU2 Arbitrary File Write Date: 28-03-18 Exploit Author: Patrick Muench, Gregor Kopf Vendor Homepage: http://www.eq-3.de Software Link: http://www.eq-3.de/service/downloads.html?id=268 Version: 2.29.23 CVE : 2018-7300 Description:...

Homematic CCU2 2.29.23 - Arbitrary File Write Exploit

Exploit for cgi platform in category web applications !/usr/bin/ruby Exploit Title: Homematic CCU2 Arbitrary File Write Date: 28-03-18 Exploit Author: Patrick Muench, Gregor Kopf Vendor Homepage: http://www.eq-3.de Software Link: http://www.eq-3.de/service/downloads.html?id=268 Version: 2.29.23 C...

Homematic CCU2 2.29.23 - Arbitrary File Write

Homematic CCU2 2.29.23 - Arbitrary File Write !/usr/bin/ruby Exploit Title: Homematic CCU2 Arbitrary File Write Date: 28-03-18 Exploit Author: Patrick Muench, Gregor Kopf Vendor Homepage: http://www.eq-3.de Software Link: http://www.eq-3.de/service/downloads.html?id=268 Version: 2.29.23 CVE :...

Homematic CCU2 2.29.23 - Arbitrary File Write

!/usr/bin/ruby Exploit Title: Homematic CCU2 Arbitrary File Write Date: 28-03-18 Exploit Author: Patrick Muench, Gregor Kopf Vendor Homepage: http://www.eq-3.de Software Link: http://www.eq-3.de/service/downloads.html?id=268 Version: 2.29.23 CVE : 2018-7300 Description:...

CVE-2018-0196

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to write arbitrary files to the operating system of an affected device. The vulnerability is due to insufficient input validation of HTTP requests that are sent to the web...

PT-2018-8662

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the web-based user interface of Cisco IOS XE Software could allow an authenticated, remote attacker to write arbitrary files to the operating system of an...

CVE-2018-0196: Improper Input Validation

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to write arbitrary files to the operating system of an affected device. The vulnerability is due to insufficient input validation of HTTP requests that are sent to the web...

Thermald Arbitrary File Write Vulnerability

thermald is a thermal daemon that is used in computers to prevent them from overheating. A security vulnerability exists in the 'main' function of the androidmain.cpp file in thermald. A local attacker can exploit this vulnerability by performing a symbolic link attack on the /tmp/thermald.pid fi...

PT-2018-3274

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.2.10 Ruby versions 2.3.x prior to 2.3.7 Ruby versions 2.4.x prior to 2.4.4 Ruby versions 2.5.x prior to 2.5.1 Ruby version 2.6.0-preview1 Description The issue exists due to incorrect restriction of the directory path...

CVE-2014-2312: Improper Link Resolution Before File Access

The main function in androidmain.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid...

PT-2018-18708

Name of the Vulnerable Software and Affected Versions Wire versions prior to 2018-03-07 Description The issue allows attackers to write to pathnames outside of the downloads directory via a ../ in a filename of a received file, related to AssetService.scala. Recommendations For versions prior to...

CVE-2018-6220

An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining code execution on vulnerable systems...

CVE-2018-6220

An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining code execution on vulnerable systems...

CVE-2018-6220

CVE-2018-6220 corresponds to an arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) that can lead to remote code execution. Connected documents describe the root cause in the update mechanism and web console components: an insecure update flow downloaded...