Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities

Binary data 800796.prm...

Design/Logic Flaw

The installer in IBM WebSphere Application Server WAS before 7.0.0.15 uses 777 permissions for a temporary log directory, which allows local users to have unintended access to log files via standard filesystem operations, a different vulnerability than CVE-2009-1173...

CVE-2011-1307

The installer in IBM WebSphere Application Server WAS before 7.0.0.15 uses 777 permissions for a temporary log directory, which allows local users to have unintended access to log files via standard filesystem operations, a different vulnerability than CVE-2009-1173...

CVE-2011-1307

CVE-2011-1307 : IBM WebSphere Application Server (WAS) prior to 7.0.0.15 uses 777 permissions for a temporary log directory in its installer, enabling local users to access log files via standard filesystem operations. This is described as a separate issue from CVE-2009-1173; affected product/ver...

CVE-2011-1307: Undefined Security Weakness

The installer in IBM WebSphere Application Server WAS before 7.0.0.15 uses 777 permissions for a temporary log directory, which allows local users to have unintended access to log files via standard filesystem operations, a different vulnerability than CVE-2009-1173...

CVE-2011-1144

The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for...

CVE-2011-1072

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories, a different vulnerability than CVE-2007-2519...

Design/Logic Flaw

The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for...

Design/Logic Flaw

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories, a different vulnerability than CVE-2007-2519...

CVE-2011-1072

The connected Nessus/NASL entries confirm CVE-2011-1072 affects the PEAR installer prior to 1.9.2, enabling local users to overwrite arbitrary files via a symlink on package.xml, related to download_dir, cache_dir, tmp_dir, and pear-build-download directories. The MiracleLinux advisory references...

CVE-2011-1144

The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for...

CVE-2011-1072

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories, a different vulnerability than CVE-2007-2519...

CVE-2011-1144

CVE-2011-1144 concerns the PEAR installer prior to 1.9.2. The vulnerability allows local users to overwrite arbitrary files via a symlink attack on package.xml, related to the download_dir, cache_dir, tmp_dir, and pear-build-download directories. The issue exists because of an incomplete fix for ...

CVE-2011-1072

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories, a different vulnerability than CVE-2007-2519...

CVE-2011-1144

The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for...

CVE-2011-1056

The installer for Metasploit Framework 3.5.1, when running on Windows, uses weak inherited permissions for the Metasploit installation directory, which allows local users to gain privileges by replacing critical files with a Trojan horse...

CVE-2011-1056

Metasploit Framework Local Privilege Escalation (CVE-2011-1056): on Windows, the Metasploit installer uses weak inherited permissions for the installation directory, enabling local users to replace critical files with a Trojan horse and gain privileges. Based on NVD/OpenVAS records, this is a loc...

CVE-2011-0741: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 installer or 2 image editor...

SuSE 11 / 11.1 Security Update : IBM Java 1.4.2 (SAT Patch Numbers 2413 / 2483)

IBM Java 1.4.2 was updated to Version U13 FP 4 iFixes, to fix the SSL renegotiation flaw reported via CVE-2009-3555. Also, SAP installer related bugs have been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Su...

VMSA-2010-0020 VMware ESXi 4.1 Update Installer SFCB Authentication Flaw

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2010-0020 Synopsis: VMware ESXi 4.1 Update Installer SFCB Authentication Flaw Issue date: 2010-12-21 Updated on: 2010-12-21 CVE...