Debian DSA-2567-1 : request-tracker3.8 - several vulnerabilities

Several vulnerabilities were discovered in Request Tracker RT, an issue tracking system. - CVE-2012-4730 Authenticated users can add arbitrary headers or content to mail generated by RT. - CVE-2012-4732 A CSRF vulnerability may allow attackers to toggle ticket bookmarks. - CVE-2012-4734 If users...

DSA-2567-1 request-tracker3.8 - several

Bulletin has no description...

[waraxe-2012-SA#089] - Multiple Vulnerabilities in TorrentTrader 2.08

waraxe-2012-SA089 - Multiple Vulnerabilities in TorrentTrader 2.08 =============================================================================== Author: Janek Vind "waraxe" Date: 17. September 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-89.html Description of vulnerable...

CVE-2012-0692: Undefined Security Weakness

CA License aka CA Licensing before 1.90.03 allows local users to modify or create arbitrary files, and consequently gain privileges, via unspecified vectors...

torrenttrader 2.08 - Multiple Vulnerabilities

torrenttrader 2.08 - Multiple Vulnerabilities waraxe-2012-SA089 - Multiple Vulnerabilities in TorrentTrader 2.08 =============================================================================== Author: Janek Vind "waraxe" Date: 17. September 2012 Location: Estonia, Tartu Web:...

MobileCartly 1.0 Arbitrary File Creation

Exploit for php platform in category web applications This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

PostgreSQL 'xslt_process()'任意文件创建或覆盖漏洞

Bugtraq ID:55072 CVE ID: CVE-2012-3488 PostgreSQL是一款对象关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL解析XSLT样式表时"xsltprocess"函数存在错误，允许攻击者利用漏洞创建或覆盖任意文件。 0 PostgreSQL 8.x PostgreSQL 9.x 厂商解决方案 PostgreSQL 9.1.5, 9.0.9, 8.4.13或8.3.20已经修复此漏洞，建议用户下载使用： http://www.postgresql.org...

CVE-2012-2968: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to create files in arbitrary directories via a .. dot dot in a pathname within an HTTP request...

CVE-2012-2627: Undefined Security Weakness

d4d/uploader.php in the web console in Plixer Scrutinizer aka Dell SonicWALL Scrutinizer before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request...

PT-2013-1492

Name of the Vulnerable Software and Affected Versions SUSE Zypper versions prior to 1.3.20 SUSE Zypper versions 1.6.x prior to 1.6.166 Description The issue allows local users to create files in arbitrary directories, or possibly have unspecified other impact, via a pathname in the ZYPP LOCKFILE...

php: XSLT file writing vulnerability

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension...

CVE-2012-1065: Undefined Security Weakness

Insecure method vulnerability in TuxScripting.dll in the TuxSystem ActiveX control in 2X ApplicationServer 10.1 Build 1224 allows remote attackers to create or overwrite arbitrary files via the ExportSettings method...

PT-2012-3053

Name of the Vulnerable Software and Affected Versions 2X ApplicationServer version 10.1 Build 1224 Description The issue concerns an insecure method vulnerability in the TuxScripting.dll component of the TuxSystem ActiveX control. This vulnerability allows remote attackers to create or overwrite...

CVE-2012-0057

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension...

CVE-2012-0057: Undefined Security Weakness

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension...

PT-2012-1218

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.9 Description The issue is related to improper security settings in the libxslt library of the PHP interpreter, which is associated with privilege management errors. This allows a remote attacker to create arbitrary...

CVE-2012-0057

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension...

Oracle AutoVue AutoVueX ActiveX Control Export3DBom Remote File Creation

An arbitrary file creation vulnerability has been reported in Oracle AutoVue ActiveX control...

CVE-2012-0393

The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object...

PT-2012-1798

Name of the Vulnerable Software and Affected Versions Siemens Tecnomatix FactoryLink versions 6.6.1 through 8.0.2.54 Description The issue allows remote attackers to create or overwrite arbitrary files. This is achieved via the save method of an unspecified ActiveX control in ActBar.ocx...