Arbitrary File Creation Vulnerability in YidaCMS Web Management System JS1.8.0 Version

YidaCMS website management system is a simple, practical and efficient website builder. YidaCMS website management system JS1.8.0 version exists arbitrary file creation vulnerability, the attacker through the creation of parsable script file, edit and save the Trojan code will be injected into th...

Arbitrary File Creation Vulnerability in ourphp v1.8.0

Ourphp website building system is a php+mysql website building system. ourphp v1.8.0 version of the existence of arbitrary file creation vulnerability, the attacker can be edited through the background of the online template comes with the creation point to create any suffix file and write Trojan...

glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation

This module attempts to gain root privileges on Linux systems by abusing a vulnerability in the GNU C Library glibc dynamic linker. glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not properly restrict use of the LDAUDIT environment variable when loading setuid executables...

CVE-2017-16606

This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. Th...

CVE-2017-16603

CVE-2017-16603 affects NetGain Systems Enterprise Manager 7.2.730 build 1034. The flaw is in the org.apache.jsp.u.jsp.settings.upload_005ffile_005fdo_jsp servlet (port 8081 by default) where filename parameter handling fails to properly validate user-supplied data, allowing an attacker to upload ...

CVE-2017-8012

In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R Watch4Net for SAS Solution Packs, the Java Management Extensions JMX protocol used to communicate between components in the Alerting and/or Compliance components can be leveraged to create a denial of service DoS condition. Attackers with knowledge o...

php-fpm Arbitrary File Creation Vulnerability

php-fpm is a PHPFastCGI process manager for PHP. A security vulnerability exists in php-fpm. A local attacker can exploit this vulnerability to perform a symbolic link attack, write to arbitrary files or create arbitrary files...

Multiple Vulnerabilities in JeeCMS v8.1 Template Management Function

JEECMS is a JEECMSv8.1 version is a collection of PC Internet, mobile Internet and WeChat website in one of the website group management system. JeeCMS v8.1 template management function exists file write, arbitrary file naming, arbitrary file creation vulnerability. An attacker can exploit the...

RubyGems: Installing a crafted gem package may create or overwrite files

There is no check for name field in metadata.gz. By assigning a maliciously crafted string like ../../../../../any/where to the field, an attacker can create an arbitrary file out of the directory of the gem, or even replace an existing file with a malicious file. Proof of Concept 1: Create a fil...

Novell ZENworks Reporting Appliance Directory Traversal Arbitrary File Creation Vulnerability

This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of Novell ZENworks Reporting Appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FCExporter servlet. The process does not properly validate a...

SyntaxHighlight 2.0 MediaWiki 1.28.0 Stored Cross Site Scripting Vulnerability

A vulnerability was found in the SyntaxHighlight MediaWiki extension. Using this vulnerability it is possible for an anonymous attacker to pass arbitrary options to the Pygments library. By specifying specially crafted options, it is possible for an attacker to trigger a stored cross site scripti...

Cisco Application-Hosting Framework Arbitrary File Creation Vulnerability

A vulnerability in the Cisco application-hosting framework CAF component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. SPDX-FileCopyrightText: 2017 Greenbone AG Some...

Cisco Application-Hosting Framework Arbitrary File Creation Vulnerability

A vulnerability in the Cisco application-hosting framework CAF component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. The vulnerability is due to insufficient input...

AttacheCase vulnerable to directory traversal

Overview AttacheCase is an open source file encryption software provided by HiBARA Software. AttacheCase contains a directory traversal vulnerability CWE-22 due to a flaw in processing filenames in ATC files. Kazuki Furukawa reported this vulnerability to IPA. JPCERT/CC coordinated with the...

Arbitrary File Creation Via A Race Condition

didjvu allows malicious local users to create arbitrary files due to insecure use of /tmp. didjvu creates a unique temporary file directly in /tmp or in $TMPDIR, and passes the name of this file to c44, which will then be used as the output filename. Unfortunately, c44 deletes the output file, an...

Microsoft Windows - VHDMP Arbitrary File Creation Privilege Escalation (MS16-138)

Microsoft Windows - VHDMP Arbitrary File Creation Privilege Escalation MS16-138 / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=914 Windows: VHDMP Arbitrary File Creation EoP Platform: Windows 10 10586 and 14393. Unlikely to work on 7 or 8.1 as I think it’s new functionality...

Microsoft Windows - VHDMP Arbitrary File Creation Privilege Escalation (MS16-138)

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=914 Windows: VHDMP Arbitrary File Creation EoP Platform: Windows 10 10586 and 14393. Unlikely to work on 7 or 8.1 as I think it’s new functionality Class: Elevation of Privilege Summary: The VHDMP driver doesn’t safely create fil...

wget: Lack of filename checking allows arbitrary file upload via FTP redirect

It was found that wget used a file name provided by the server for the downloaded file when following a HTTP redirect to a FTP server resource. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client...

metinfo 5.3.1 任意文件创建漏洞(后台)

No description provided by source...

Advantech WebAccess Dashboard Viewer saveGeneralFile Arbitrary File Creation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WebAccess Dashboard Viewer. Insufficient validation within the SaveGeneralFile...