MGASA-2017-0101 Updated munin packages fix security vulnerability

Stevie Trujillo discovered a local file write vulnerability in munin, a network-wide graphing framework, when CGI graphs are enabled. GET parameters are not properly handled, allowing to inject options into munin-cgi-graph and overwriting any file accessible by the user running the cgi-process...

WordPress Chat-Room Plugin Has Multiple Vulnerabilities

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.Chat-Room is one of the chat room plug-ins. A directory traversal and arbitrary file write vulnerability exists i...

WordPress Chat-Room plugin v0.1.2 directory traversal/arbitrary file write Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress Chat-Room plugin v0.1.2 directory traversal/arbitrary file write Date: 2017-03-08 Exploit Author: malwrforensics Vendor Homepage: https://webdevstudios.com/ Software Link: https://wordpress.org/plugins/chat-room/...

Design_edittheme2.php Arbitrary File Write Vulnerability in Ohoo Government System

Ohuhu government system is the government portal system of Shanghai Ohuhu Network Technology Co. An arbitrary file write vulnerability exists in the designedittheme2.php file of the Ohuhu government system. This vulnerability allows attackers to write arbitrary files and gain server privileges...

ohocms design_edittheme2. php file write vulnerability

No description provided by source...

CVE-2016-6255

Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler...

Design/Logic Flaw

Portable UPnP SDK aka libupnp before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler...

Security update for munin (important)

This update for munin fixes the following issues: - An attacker has been able to write arbitrary local files with the permissions of the web server, by using parameter injection boo1026539, CVE-2017-6188 - The MySQL plugin has been fixed to work correctly against MySQL 5.5 on Leap 42.1...

BullIBM AIX ClusterwatchWatchware - Multiple Vulnerabilities

BullIBM AIX ClusterwatchWatchware - Multiple Vulnerabilities Bull Clusterwatch/Watchware is a VERY VERY OLD tool used by sysadmins to manage their AIX clusters. Marble effect in the web banner and questionable font: it smells the 90s ! Tool is mainly a web app with CGIs shell scripts and binaries...

Bull/IBM AIX Clusterwatch/Watchware - Multiple Vulnerabilities

Bull Clusterwatch/Watchware is a VERY VERY OLD tool used by sysadmins to manage their AIX clusters. Marble effect in the web banner and questionable font: it smells the 90s ! Tool is mainly a web app with CGIs shell scripts and binaries and we have found three vulnerabilities in it: Trivial admin...

Bull / IBM AIX Clusterwatch / Watchware File Write / Command Injection

Bull Clusterwatch/Watchware is a VERY VERY OLD tool used by sysadmins to manage their AIX clusters. Marble effect in the web banner and questionable font: it smells the 90s ! Tool is mainly a web app with CGIs shell scripts and binaries and we have found three vulnerabilities in it: Trivial admin...

CWCMS background admin/cw_skin.php page has arbitrary file write vulnerability

CWCMS is an enterprise website management system. An arbitrary file write vulnerability exists in the admin/cwskin.php page of the CwCMS-PHP enterprise website management system, allowing attackers to write arbitrary executable files and gain server privileges...

[SECURITY] [DSA 3794-3] munin regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3794-3 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3794-3] munin regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3794-3 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 03, 2017 https://www.debian.org/security/faq -...

Rapid7 Metasploit Directory Traversal Vulnerability (CNVD-2017-02665)

Metasploit Pro is a guided penetration testing platform. A directory traversal vulnerability exists in the Meterpreter stdapi Dir.download function in versions of Rapid7 Metasploit prior to 4.13.0-2017020701. An attacker can exploit the vulnerability to write arbitrary files on the Metasploit...

CVE-2017-5229

All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parsedump function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console...

CVE-2017-5228

All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the...

[SECURITY] [DSA 3794-2] munin regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3794-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 02, 2017 https://www.debian.org/security/faq -...

rubyzip gem Zip::File component directory traversal vulnerability

The rubyzip gem is a Ruby library for reading and writing zip files. A directory traversal vulnerability exists in the Zip::File component of the rubyzip gem. An attacker can exploit the vulnerability by uploading a malicious file to write an arbitrary file to the file system...

CVE-2017-5946

CVE-2017-5946 – Rubyzip directory traversal vulnerability : The Zip::File component of the rubyzip gem for Ruby (pre-1.2.1) allows a ZIP archive to write files outside the target directory when a ZIP upload contains paths with "..". This enables arbitrary file writes on the filesystem if a site p...