[SECURITY] [DSA 4628-1] php7.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4628-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 18, 2020 https://www.debian.org/security/faq -...

Debian DSA-4626-1 : php7.3 - security update

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in information disclosure, denial of service or incorrect validation of path names. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Authentication flaw

A vulnerability has been identified in OZW672 All versions V10.00, OZW772 All versions V10.00. Vulnerable versions of OZW Web Server use predictable path names for project files that legitimately authenticated users have created by using the application's export function. By accessing a specific...

CVE-2019-13941

A vulnerability has been identified in OZW672 All versions V10.00, OZW772 All versions V10.00. Vulnerable versions of OZW Web Server use predictable path names for project files that legitimately authenticated users have created by using the application's export function. By accessing a specific...

Siemens OZW Web Server

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: OZW web server Vulnerability: Information disclosure 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unauthenticated users to access project files...

The vulnerability of Junos OS routers from the NFX150, EX9200 series, with NG-RE, MX with NG-RE, PTX with NG-RE, and QFX10K with NG-RE families, arises due to incorrect restrictions on path names to restricted access directories. This allows attackers to gain unauthorized access to protected information.

The vulnerability of Junos OS router models in the NFX150, EX9200 with NG-RE, MX with NG-RE, PTX with NG-RE, and QFX10K with NG-RE series is related to incorrect restrictions on path names to restricted directories. Exploiting this vulnerability can allow an attacker to gain unauthorized access t...

CVE-2018-12297

Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names...

CVE-2018-12297

Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names...

Cross site scripting

Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names...

CVE-2018-12297

Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names...

CVE-2018-12297

CVE-2018-12297 affects Seagate NAS OS 4.3.15.1 with XSS in API error pages via URL path names. Root cause cited as insufficient validation of client data by the WEB application; impact is client-side script execution. Exploitation details/works are not provided in the documents; no remediation/ve...

USN-3132-1: tar vulnerability

Harry Sintonen discovered that tar incorrectly handled extracting files when path names are specified on the command line. If a user or automated system were tricked into processing a specially crafted archive, an attacker could possibly overwrite arbitrary files...

The vulnerability of the iOS operating system, allowing a hacker to read arbitrary files

The vulnerability of the Mobile Backup module in the Photos app of the iOS operating system is related to deficiencies in path name restrictions for the catalog. Exploiting this vulnerability allows a malicious actor to read arbitrary files through a specially crafted path name...

The vulnerability of the Internet Explorer browser, which allows a hacker to read arbitrary local files

The vulnerability of the Internet Explorer browser is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to read arbitrary local files using a specially created path name...

DEBIAN-CVE-2015-3184

modauthzsvn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name...

Ubuntu: Security Advisory (USN-2598-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

namei in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service memory exhaustion via vectors that trigger a sandboxed process to look up a large number of nonexistent path names...

CVE-2014-3711

namei in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service memory exhaustion via vectors that trigger a sandboxed process to look up a large number of nonexistent path names...

Oracle Linux 6 : samba4 (ELSA-2014-1009)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1009 advisory. - resolves: 1126011 - CVE-2014-3560: remote code execution in nmbd. - resolves: 1105501 - CVE-2014-0244: DoS in nmbd. - resolves: 1108842 - CVE-2014-3493: DoS i...

samba: smbd unicode path names denial of service

It was discovered that smbd, the Samba file server daemon, did not properly handle certain files that were stored on the disk and used a valid Unicode character in the file name. An attacker able to send an authenticated non-Unicode request that attempted to read such a file could cause smbd to...