CVE-2008-4477: Improper Link Resolution Before File Access

alert.d/test.alert in mon 0.99.2 allows local users to overwrite arbitrary files via a symlink attack on the test.alert.log temporary file...

CVE-2008-4471: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control AdView.dll 9.0.0.96, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via ".." sequences in the argument to the SaveAS...

CVE-2008-4440: Improper Link Resolution Before File Access

The to-upgrade plugin in feta 1.4.16 allows local users to overwrite arbitrary files via a symlink on the 1 /tmp/feta.install.$USER and 2 /tmp/feta.avail.$USER temporary files...

Gentoo Security Advisory GLSA 200611-23 (mono)

The remote host is missing updates announced in advisory GLSA 200611-23. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

CVE-2008-4191: Improper Link Resolution Before File Access

extract-table.pl in Emacspeak 26 and 28 allows local users to overwrite arbitrary files via a symlink attack on the extract-table.csv temporary file...

CVE-2008-4108: Improper Link Resolution Before File Access

Tools/faqwiz/move-faqwiz.sh aka the generic FAQ wizard moving tool in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directo...

CVE-2008-3930

migratealiases.sh in Citadel Server 7.37 allows local users to overwrite arbitrary files via a symlink attack on a temporary file...

CVE-2008-3930: Improper Link Resolution Before File Access

migratealiases.sh in Citadel Server 7.37 allows local users to overwrite arbitrary files via a symlink attack on a temporary file...

CVE-2008-3928: Improper Link Resolution Before File Access

test.sh in Honeyd 1.5c might allow local users to overwrite arbitrary files via a symlink attack on a temporary file...

CVE-2008-3929: Improper Link Resolution Before File Access

gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filelist temporary file...

CVE-2008-3883: Improper Link Resolution Before File Access

configvar in Caudium 1.4.12 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/roken.pike temporary file...

CVE-2008-3699: Improper Link Resolution Before File Access

The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the albuminfo.xml temporary file...

CVE-2008-2958: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in 1 checkinstall 1.6.1 and 2 installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories...

CVE-2007-5495: Improper Link Resolution Before File Access

sealert in setroubleshoot 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the sealert.log temporary file...

CVE-2008-2283

IDAutomation allows remote attackers to overwrite arbitrary files via the argument to the 1 SaveBarCode and 2 SaveEnhWMF methods in a the IDAuto.BarCode.1 ActiveX control in IDAutomationLinear6.dll aka IDAutomation Linear BarCode 1.6.0.6, b the IDAuto.Datamatrix.1 ActiveX control in...

CVE-2008-2266

uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated by the tempnam function. NOTE: this may be a CVE-2004-2265 regression...

CVE-2008-2266: Improper Link Resolution Before File Access

uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated by the tempnam function. NOTE: this may be a CVE-2004-2265 regression...

CVE-2008-1901: Improper Link Resolution Before File Access

aptlinex before 0.91 allows local users to overwrite arbitrary files via a symlink attack on the gambas-apt.lock temporary file...

CVE-2008-1694: Improper Link Resolution Before File Access

vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files...

Design/Logic Flaw

The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx in IBiz E-Banking Integrator formerly IBiz OFX Integrator 2.0.2932 exposes the unsafe WriteOFXDataFile method, which allows remote attackers to overwrite arbitrary files via a full pathname in the argument. NOTE: some of these details a...