Red Hat Automatic Bug Reporting Tool任意文件写入漏洞

问题在abrt-action-install-debuginfo-to-abrt-cache 在默认的情况下，它会在/var/tmp/abrt-tmp-debuginfo-RANDOMSUFFIX创建一个临时文件,然后会下载rpm文件到这个文件夹，之后会进行解压，因为是临时文件夹，所以解压的路径不是这个，而是在/var/cache/abrt-di,但是因为这个文件夹并不是随机创建的，而且可预测性极强，所以我们可以提前创建这个文件夹，依靠控制unpacked.cpio这个文件，我们就能欺骗abrt-action-install-debuginfo提取一个我们可控制的cpio文件...

Red Hat Automatic Bug Reporting Tool Arbitrary File Write Vulnerability

Red Hat Automatic Bug Reporting Tool ABRT is a set of automated bug detection and reporting tools from Red Hat Red Hat. A security vulnerability exists in the abrt-action-install-debuginfo-to-abrt-cache help program in Red Hat ABRT versions prior to 2.7.1. A local attacker can exploit the...

CVE-2015-5273

CVE-2015-5273 affects ABRT and libreport: the abrt-action-install-debuginfo-to-abrt-cache helper allows a local attacker to write arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp. Public advisories (RHSA/CESA) and distributed sec...

Oracle BeeHive 2 - 'voice-servlet processEvaluation()' Write File (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Oracle BeeHive 2 voice-servlet processEvaluation Vulnerability", 'Description' = %q This module exploits a vulnerability found in...

Design/Logic Flaw

Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow remote attackers to bypass intended access restrictions and writ...

flash-plugin: multiple code execution issues fixed in APSB15-28

Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow remote attackers to bypass intended access restrictions and writ...

flash-plugin: multiple code execution issues fixed in APSB15-28

Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow remote attackers to bypass intended access restrictions and writ...

CVE-2015-7662

Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow remote attackers to bypass intended access restrictions and writ...

Oracle Beehive prepareAudioToPlay Arbitrary File Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Beehive. Authentication is not required to exploit this vulnerability. The specific flaw exists within the voice-servlet's playAudioFile.jsp. The method prepareAudioToPlay contains vulnerabl...

Janitza UMG Arbitrary File Read/Write Vulnerability

The Janitza UMG is an online power quality monitor for the energy industry from Janitza Germany. An arbitrary file read/write vulnerability exists in Janitza UMG 508, 509, 511, 604,605. This allows remote attackers to read or write files, or execute arbitrary JASIC code via a session with TCP por...

CVE-2015-5669

Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary code via unspecified vectors...

Apple Mac OS X Multiple Vulnerabilities-02 (Oct 2015)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-6984

CVE-2015-6984 affects Apple OS X before 10.11.1 via libarchive. A crafted app can trigger a symlink attack to write to arbitrary files due to path/symlink handling in libarchive. Impact: arbitrary file writes. Mitigation: update to OS X 10.11.1 / Security Update 2015-007.

CVE-2015-6318

Cisco TelePresence VCS Expressway X8.5.1/X8.5.2 is affected by a local, authenticated symbolic-link attack in the file handling of the request-xconfdump path, enabling write access to arbitrary linked files due to insufficient protection. Exploitation can allow insertion of arbitrary content into...

FreeBSD : james -- multiple vulnerabilities (be3069c9-67e7-11e5-9909-002590263bf5)

The Apache James Project reports : This release has many enhancements and bug fixes over the previous release. See the Release Notes for a detailed list of changes. Some of the earlier defects could turn a James mail server into an Open Relay and allow files to be written on disk. All users of...

Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write

This module exploits a vulnerability that exists due to a lack of input validation when creating a user. Messages for a given user are stored in a directory partially defined by the username. By creating a user with a directory traversal payload as the username, commands can be written to a given...

Mozilla Firefox and Firefox ESR updater.exe Privilege Bypass Vulnerability

Mozilla Firefox is an open source web browser. A security vulnerability exists in the Mozilla Firefox updater.exe file that allows local attackers to perform a symbolic link attack to write arbitrary files at program startup...

MoboTap Dolphin Browser for Android Arbitrary File Write Vulnerability

MoboTap Dolphin Browser for Android is a dolphin browser for the Android platform. MoboTap Dolphin Browser for Android suffers from an arbitrary file write vulnerability that can be exploited by remote attackers to construct a malicious web page that can be parsed and written to arbitrary files...

FineCms 免费版任意文件上传漏洞

路径：dayrui/libraries/Chart/ofcuploadimage.php $defaultpath = '../tmp-upload-images/'; if !fileexists$defaultpath mkdir$defaultpath, 0777, true; $destination = $defaultpath . basename $GET 'name' ; echo 'Saving your image to: '. $destination; $jfh = fopen$destination, 'w' or die"can't open file";...

libvdpau Arbitrary File Write Vulnerability

libvdpau is a Unix-like system video decoding and presentation API interface VDAPU Video Decode and Presentation API for Unix in the open source library files. An arbitrary file write vulnerability exists in versions of libvdpau prior to 1.1.1, which allows local users to write arbitrary files vi...