952 matches found
CVE-2011-2652
CVE-2011-2652 affects Kiwi prior to 3.74.2, including deployments in SUSE Studio 1.1 before 1.1.4. The vulnerability arises from a cross-site scripting flaw in the overlay file workflow triggered by a crafted archive file list, enabling remote attackers to inject arbitrary scripts/HTML. Impact is...
CVE-2011-2652
Cross-site scripting XSS vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via a crafted archive file list that is used in an overlay file...
CVE-2011-2648
CVE-2011-2648 affects Kiwi prior to 3.74.2 as used in SUSE Studio 1.1 prior to 1.1.4. The vulnerability permits remote code execution via a filter in a modified file. This CVE has a documented CVSSv2 base score of 7.5 (HIGH) with network access, low attack complexity, no authentication, and parti...
CVE-2011-2647
Kiwi before 3.74.2 contains a remote code execution vulnerability exploitable via a crafted archive name in the list of testdrive modified files, as used in SUSE Studio 1.1 before 1.1.4. The issue is documented in multiple sources (SUSE/SUSE CVE, NVD) with the affected component being Kiwi, and t...
CVE-2011-2649
Kiwi before 3.74.2 (as used in SUSE Studio 1.1 before 1.1.4) is vulnerable to command execution via shell metacharacters in an unspecified FileUtils function. The root cause is not fully detailed in the provided documents, but the vulnerability allows an attacker to execute arbitrary commands. Th...
CVE-2011-2644
The CVE-2011-2644 entry affects Kiwi prior to version 3.74.2 (used in SUSE Studio 1.1 prior to 1.1.4). The vulnerability is described as a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to an RPM info display. I...
CVE-2011-2226
Cross-site scripting XSS vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a pattern listing...
CVE-2011-2646
Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename in the list of testdrive modified files...
CVE-2011-2645
Kiwi before 3.74.2, used in SUSE Studio 1.1 before 1.1.4, contains an unspecified vulnerability that allows remote attackers to execute arbitrary code via a crafted filename for a custom RPM. The issue is documented across multiple sources (SUSE CVE entry and NVD) with no publicly detailed root-c...
CVE-2011-2647
Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted archive name in the list of testdrive modified files...
Kiwi Syslog Server Web Access Login Username Enumeration
Kiwi Syslog Web Access is installed on the remote host. The installed version responds with different error messages when an user attempts to login with existent and non-existent accounts. A remote unauthenticated attacker may exploit this vulnerability to enumerate valid users for the remote web...
Kiwi CatTools < 3.2.9 Directory Traversal - Active Check
The remote host appears to be running Kiwi CatTools, a freeware application for device configuration management and is affected by a directory traversal vulnerability. SPDX-FileCopyrightText: 2008 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and are Copyrigh...
Kiwi CatTools < 3.2.9 Directory Traversal - Active Check
The remote tftpd server is affected by a directory traversal vulnerability. SPDX-FileCopyrightText: 2008 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
kiwicat-exec.txt
Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 server can lead to information disclosure and remote code execution Risk: High DISCUSSION Kiwi CatTools TFTP server doesn't properly verify filename in PUT and GET request which can be used to download/upload any file from/to...
Kiwi CatTools < 3.2.9 TFTP Server Traversal Arbitrary File Manipulation
The remote host appears to be running Kiwi CatTools, a freeware application for device configuration management. The TFTP server included with the version of Kiwi CatTools installed on the remote host fails to sanitize filenames of directory traversal sequences. An attacker can exploit this issue...
Kiwi CatTools TFTP <= 3.2.8 Remote Path Traversal Vulnerability
No description provided by source. Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 server can lead to information disclosure and remote code execution Risk: High DISCUSSION Kiwi CatTools TFTP server doesn.t properly verify filename in PUT and GET request which can be used ...
Kiwi CatTools TFTP <= 3.2.8 Remote Path Traversal Vulnerability
Exploit for unknown platform in category remote exploits =============================================================== Kiwi CatTools TFTP tftp -i 10.1.1.2 GET /x/../../../../../boot.ini boot.txt Transfer successful: 212 bytes in 1 second, 212 bytes/s C:\type boot.txt boot loader timeout=30...
[Full-disclosure] Kiwi CatTools TFTP server path traversal
Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 server can lead to information disclosure and remote code execution Risk: High DISCUSSION Kiwi CatTools TFTP server doesn't properly verify filename in PUT and GET request which can be used to download/upload any file from/to...
Kiwi CatTools TFTP 3.2.8 - Directory Traversal
Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 server can lead to information disclosure and remote code execution Risk: High DISCUSSION Kiwi CatTools TFTP server doesn.t properly verify filename in PUT and GET request which can be used to download/upload any file from/to...