CVE-2009-4315: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magicquotesgpc is disabled, allows remote attackers to create or modify arbitrary files via a .. dot dot in the nugget parameter and a modified pagevalue parameter, as demonstrated by creating and accessing a .php fi...

CVE-2009-3898: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in src/http/modules/ngxhttpdavmodule.c in nginx aka Engine X before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. dot dot in the Destination HTTP header for the WebDAV 1 COPY or 2 MOVE method...

Design/Logic Flaw

Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create arbitrary files with any contents, and thereby execute arbitrary code, via crafted JavaScript, related to a "design issue."...

CVE-2009-3860: Undefined Security Weakness

Multiple insecure method vulnerabilities in Idefense Labs COMRaider allow remote attackers to create or overwrite arbitrary files via the 1 CreateFolder and 2 Copy methods. NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer...

Internet Explorer FTP Client Directory Traversal (CVE-2004-1376)

Microsoft Internet Explorer IE incorporates an FTP client component that is capable of communicating with standard FTP servers. To invoke the FTP functionality in order to view files on an FTP server, a URI of the ftp:// scheme is used. When no specific file is indicated with the URL such as...

GLSA-200910-03 : Adobe Reader: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200910-03 Adobe Reader: Multiple vulnerabilities Multiple vulnerabilities were discovered in Adobe Reader. For further information please consult the CVE entries and the Adobe Security Bulletin referenced below. Impact : A remote...

CVE-2009-2993: Improper Input Validation

The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 does not properly implement the 1 Privileged Context and 2 Safe Path restrictions for unspecified JavaScript methods, which allows remote attackers to create arbitrary files, and...

CVE-2009-3573: Undefined Security Weakness

Multiple insecure method vulnerabilities in the PDIControl.PDI.1 ActiveX control PDIControl.dll 2.2.3160.0 in EMC Captiva PixTools Distributed Imaging 2.2 allow remote attackers to create or overwrite arbitrary files via the 1 SetLogFileName and 2 WriteToLog methods...

RHEL 5 : java-1.4.2-ibm (RHSA-2008:0955)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0955 advisory. - Java RE allows Same Origin Policy to be Bypassed 6687932 CVE-2008-3104 - Java Web Start, arbitrary file creation 6703909 CVE-2008-3112 -...

iDefense Security Advisory 08.06.09: IBM AIX libC _LIB_INIT_DBG Arbitrary File Creation Vulnerability

iDefense Security Advisory 08.04.09 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 04, 2009 I. BACKGROUND IBM's AIX is a Unix operating system based on System V, which runs on the PowerPC PPC architecture. For more information, visit the product web site at the following URL...

CVE-2009-2676: Undefined Security Weakness

Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.221 and earlier; allows remote attackers to create or modify arbitrary files via vecto...

CVE-2008-2154: Undefined Security Weakness

IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 provides an INSTALLJAR aka sqlj.installjar procedure, which allows remote authenticated users to create or overwrite arbitrary files via unspecified calls...

CVE-2009-1786: Concurrent Execution using Shared Resource with Improper Synchronization

The malloc subsystem in libc in IBM AIX 5.3 and 6.1 allows local users to create or overwrite arbitrary files via a symlink attack on the log file associated with the MALLOCDEBUG environment variable...

CVE-2009-1743: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to create and overwrite arbitrary files via a filename containing a ..\ dot dot backslash sequence in a Hollywood FX Compressed...

CVE-2009-1678: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create or overwrite arbitrary files via a .. dot dot in the version parameter to boards/boardsrss.php...

CVE-2009-1314

body.asp in Web File Explorer 3.1 allows remote attackers to create arbitrary files and execute arbitrary code via the savefile action with a file parameter containing a filename that has an executable extension...

CVE-2009-1314: Undefined Security Weakness

body.asp in Web File Explorer 3.1 allows remote attackers to create arbitrary files and execute arbitrary code via the savefile action with a file parameter containing a filename that has an executable extension...

CVE-2008-6591

CVE-2008-6591 affects LightNEasy “no database” (flat) version 1.2.2 (and possibly SQLite 1.2.2). The vulnerability allows remote attackers to create arbitrary files via the page parameter to (1) index.php and (2) LightNEasy.php. Connected docs confirm the affected software and the vulnerable para...

CVE-2008-6591: Improper Control of Generation of Code

LightNEasy "no database" aka flat version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to 1 index.php and 2 LightNEasy.php...

CVE-2009-1215: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file...