GLSA-200712-11 : Portage: Information disclosure

The remote host is affected by the vulnerability described in GLSA-200712-11 Portage: Information disclosure Mike Frysinger reported that the 'etc-update' utility uses temporary files with the standard umask, which results in the files being world-readable when merging configuration files in a...

Portage information leak

etc-update utilities stores sensitive information in insecure temporayr file...

Design/Logic Flaw

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file...

CVE-2007-6249

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file...

CVE-2007-6249

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file...

CVE-2007-6249

CVE-2007-6249 concerns Portage (Gentoo) = 2.1.3.11 (or apply equivalent patches) to mitigate the risk. If upgrading is not immediately possible, be aware that the description and related GLSAs/Nessus entries consistently describe an information-disclosure impact due to insecure temporary files du...

CVE-2007-6249: Exposure of Sensitive Information to an Unauthorized Actor

etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissions weaker than those of the original files, which might allow local users to obtain sensitive information by reading the merge file...

xml2owl 0.1.1 (filedownload.php) Remote File Disclosure Vulnerability

No description provided by source. xml2owl 0.1.1 filedownload.php Remote File Disclosure Vulnerability D.s : http://surfnet.dl.sourceforge.net/sourceforge/xml2owl/xml2owl-0.1.1.tar.bz2 POC : /xml2owl-0.1.1/filedownload.php?file=config.inc.php...

EZContents 1.4.5 - index.php?link Remote File Disclosure

EZContents 1.4.5 - index.php?link Remote File Disclosure -------------------------------------------------------------- ezContents Version 1.4.5 Remote File Disclosure Vulnerability. -------------------------------------------------------------- download : http://www.visualshapers.com/ author :...

KB-Bestellsystem - kb_whois.cgi Command Execution

KB-Bestellsystem - kbwhois.cgi Command Execution "KB-Bestellsystem" is a domain order system written in Perl. The "domain" and "tld" parameters in "kbwhois.cgi" are not filtering shell metacharacters. The following examples will show you the /etc/passwd file:...

RHEL 5 : pam (RHSA-2007:0555)

Updated pam packages that fix two security flaws, resolve several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pluggable Authentication Modules PAM provide a system...

Fedora 7 : util-linux-2.13-0.54.1.fc7 (2007-2462)

Mon Oct 8 2007 Karel Zak 2.13-0.54.1 - fix 320131 - CVE-2007-5191 util-linux umount doesn't drop privileges properly when calling helpers F7 - Wed Aug 8 2007 Karel Zak 2.13-0.54 - backport mount relatime patch - Thu Aug 2 2007 Karel Zak 2.13-0.53 - fix 236848 - mount/fstab.c:lockmtab should open...

CVE-2007-5827

iSCSI Enterprise Target iscsitarget 0.4.15 uses weak permissions for /etc/ietd.conf, which allows local users to obtain passwords...

CVE-2007-5827

iSCSI Enterprise Target iscsitarget 0.4.15 uses weak permissions for /etc/ietd.conf, which allows local users to obtain passwords...

visolfi.txt

Title : VISO apps Local File Inclusion Vulnerability Description : VISO apps is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Software: : http://www.viventus.no/visoapps/ Author : d3hydr8 Homepage : http://www.darkc0de.com Original Post :...

CVE-2007-4272

Multiple vulnerabilities in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to create arbitrary files via 1 unspecified vectors where an attacker's umask is honored, 2 /etc/ld.so.preload, 3 certain "cron data file locations", and other unspecified vectors possibly involvi...

Design/Logic Flaw

Multiple vulnerabilities in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to create arbitrary files via 1 unspecified vectors where an attacker's umask is honored, 2 /etc/ld.so.preload, 3 certain "cron data file locations", and other unspecified vectors possibly involvi...

CVE-2007-4321

fail2ban 0.8 and earlier does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a client protocol versi...

Directory traversal

Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 Adonis DNS/DHCP appliance 5.0.2.8 allows remote authenticated administrators, with certain TFTP privileges, to create and overwrite arbitrary files via a .. dot dot in a pathname. NOTE: this can be leveraged...

CVE-2007-4226

Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 Adonis DNS/DHCP appliance 5.0.2.8 allows remote authenticated administrators, with certain TFTP privileges, to create and overwrite arbitrary files via a .. dot dot in a pathname. NOTE: this can be leveraged...