Information disclosure

Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink...

Command injection

AppleFileConduit in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via an afc command that leverages symlink mishandling...

CVE-2015-5752

Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink...

CVE-2015-5752

CVE-2015-5752 (Apple iOS Backup Symbolic Link Vulnerability) Affected software: Apple iOS prior to 8.4.1, specifically the Backup component. Root cause: A symbolic link handling flaw in the backup mechanism allowed a crafted app to create symlinks that bypassed intended filesystem access restrict...

CVE-2015-5752: Improper Link Resolution Before File Access

Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink...

CVE-2015-5766: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Air Traffic in Apple iOS before 8.4.1 allows attackers to access arbitrary filesystem locations via vectors related to asset handling...

CVE-2015-5746: Improper Access Control

AppleFileConduit in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via an afc command that leverages symlink mishandling...

PT-2015-1914

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.4.1 Description The issue allows attackers to access arbitrary filesystem locations due to a directory traversal vulnerability in the Air Traffic component. This is caused by incorrect restriction of the path name...

CVE-2015-4235

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03o and 1.1 before 1.11j and Nexus 9000 ACI devices with software before 11.04o and 11.1 before 11.11j do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain...

Koha 3.20.1 - Multiple SQL Injections

Koha 3.20.1 - Multiple SQL Injections Exploit Title: Koha Open Source ILS - Unauthenticated SQL Injection in OPAC Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research...

Koha 3.20.1 - Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Koha Open Source ILS - Unauthenticated SQL Injection in OPAC Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research...

php: regressions in 5.4+

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions...

SUSE SLES11 Security Update : wget (SUSE-SU-2014:1366-2)

wget was updated to fix one security issue and two non-security issues : - FTP symbolic link arbitrary filesystem access CVE-2014-4877. - Fix displaying of download time bnc901276. - Fix 0 size FTP downloads after failure bnc885069. Note that Tenable Network Security has extracted the preceding...

MGASA-2015-0207 Updated postgis packages fix security vulnerabilities

Updated postgis packages fix security vulnerability: The PostGIS Raster support in PostGIS before 2.1.3 may give more privileges to users than an administrator is willing to grant. These include reading files from the filesystem and opening connections to network hosts. The postgis package has be...

Apple Fixes WebKit Vulnerabilities in Safari Browser

Apple has updated its Safari browser, fixing a handful of exploitable WebKit flaws in various versions of Safari. WebKit is the core layout engine responsible for rendering webpages in the Safari browser. The first bulletin, vulnerabilities uncovered by Apple, resolves multiple memory corruption...

[ MDVSA-2015:051 ] sympa

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:051 http://www.mandriva.com/en/support/security/ Package : sympa Date : March 3, 2015 Affected: Business Server 1.0 Problem Description: Updated sympa packages fix security vulnerability: A vulnerability hav...

DEBIAN-CVE-2015-0274

The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service transaction overrun and data corruption or possibly gain privileges by leveraging XFS filesystem access...

CVE-2015-0274

The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service transaction overrun and data corruption or possibly gain privileges by leveraging XFS filesystem access...

CVE-2015-0274

The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service transaction overrun and data corruption or possibly gain privileges by leveraging XFS filesystem access...

APPLE-SA-2015-01-27-1 Apple TV 7.0.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-01-27-1 Apple TV 7.0.3 Apple TV 7.0.3 is now available and addresses the following: Apple TV Available for: Apple TV 3rd generation and later Impact: A maliciously crafted afc command may allow access to protected parts of the filesystem...