138 matches found
ZrLog Cross-Site Scripting Vulnerability
ZrLog is a blogging system developed using the Java language. A cross-site scripting vulnerability exists in the file upload feature in ZrLog version 2.0.3. A remote attacker can exploit this vulnerability by injecting arbitrary web script or HTML using a specially crafted attached/file/ pathname...
Arbitrary File Read
redhat-access-plugin-openstack is vulnerable to arbitrary file read. The vulnerability exists as the log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard horizon allows remote attackers to read arbitrary files via a crafted path...
zsh: buffer overflow when scanning very long directory paths for symbolic links
A buffer overflow flaw was found in the zsh shell symbolic link resolver. A local, unprivileged user can create a specially crafted directory path which leads to a buffer overflow in the context of the user trying to do symbolic link resolution in the aforementioned path. An attacker could exploi...
zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c
A buffer overflow flaw was found in the zsh shell auto-complete functionality. A local, unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use auto-complete to traverse the before mentioned path. If the user affect...
CVE-2018-5137
A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this by using a maliciously crafted path string to reference the resources. Note: this vulnerability does not affect WebExtensions. This vulnerability affects...
UBUNTU-CVE-2018-5137
A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this by using a maliciously crafted path string to reference the resources. Note: this vulnerability does not affect WebExtensions. This vulnerability affects...
Node.js third-party modules: `foreman` is vulnerable to ReDoS in path
I would like to report ReDoS in foreman. It allows to cause denial of service by suppling a crafted path. Module module name: foreman version: 2.0.0 npm page: https://www.npmjs.com/package/foreman Module Description Node Foreman is a Node.js version of the popular Foreman tool, with a few Node...
vmware horizon client dll hijacking vulnerability
Horizon Client is used to virtualize desktops and applications. A DLL hijacking vulnerability exists in the vmware horizon client, which could allow an attacker to maliciously load a DLL and execute arbitrary commands by constructing a malicious application and placing it in a specific path...
Ubuntu click privilege acquisition vulnerability
Ubuntu is a desktop-oriented GNU/Linux operating system developed by Canonical and the Ubuntu Foundation.Ubuntu LTS is a long-supported version of Ubuntu. click is one of the filesystems in which third-party applications are installed in a simplified packaging format. A security vulnerability...
CVE-2016-7222
Task Scheduler in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows local users to gain privileges via a crafted UNC pathname in a task, aka "Task Scheduler Elevation of Privilege Vulnerability."...
The vulnerability of the EMC Unisphere data storage management program allows a hacker to modify arbitrary files.
The vulnerability of the HTTP server of the vApp Manager component in the EMC Unisphere data management software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to modify arbitrary files through a specially crafted path name...
CVE-2016-1505
The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore...
The vulnerability of the iOS operating system allows a hacker to execute arbitrary code in a privileged context.
The vulnerability of the Mobile Replayer component in the GPUTools Framework for the iOS operating system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged context using an application that specifies a specially...
The vulnerability of the iOS operating system allows a hacker to execute arbitrary code in a privileged context.
The vulnerability of the Mobile Replayer component in the GPUTools Framework for the iOS operating system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged context using an application that specifies a specially...
The vulnerability of the Internet Explorer browser, which allows a hacker to read arbitrary local files
The vulnerability of the Internet Explorer browser is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to read arbitrary local files using a specially created path name...
Path traversal
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allow remote administrators to read arbitrary files and obtain passwords via a crafted path...
CVE-2014-9712
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allow remote administrators to read arbitrary files and obtain passwords via a crafted path...
CVE-2015-0271
The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard horizon allows remote attackers to read arbitrary files via a crafted path...
CVE-2015-0271
CVE-2015-0271 affects Red Hat OpenStack Horizon’s redhat-access-plugin (pre-6.0.3). The vulnerability arises from an unsanitized input in the log-viewing function, allowing an authenticated attacker to read arbitrary files via a crafted path. Impact is reading sensitive files with the web server’...