Ruby: Untrusted codes able to modify arbitrary strings

The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exceptiontos method, as demonstrated by changing an intended pathname...

CVE-2011-1758

The krb5saveccnamedone function in providers/krb5/krb5auth.c in System Security Services Daemon SSSD 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by...

CVE-2011-1758

The krb5saveccnamedone function in providers/krb5/krb5auth.c in System Security Services Daemon SSSD 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by...

CVE-2011-1758: Improper Authentication

The krb5saveccnamedone function in providers/krb5/krb5auth.c in System Security Services Daemon SSSD 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by...

CVE-2011-1595

Directory traversal vulnerability in the diskcreate function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. dot dot in a pathname...

CVE-2011-1595

Directory traversal vulnerability in the diskcreate function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. dot dot in a pathname...

CVE-2011-1607

Directory traversal vulnerability in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.x before 6.15su3, 7.x before 7.15bsu3, 8.0 before 8.03asu1, and 8.5 before 8.51 allows remote authenticated users to upload files to arbitrary directories via a modified pathname in an uploa...

PT-2011-3185

Name of the Vulnerable Software and Affected Versions IBM Lotus Domino versions 7.x through 8.x Description The issue allows remote attackers to bypass authentication and execute arbitrary code by manipulating the COOKIEFILE field to point to a file located at a UNC share pathname. This enables...

DEBIAN-CVE-2010-4651

Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. dot dot or full pathname, a related issue to CVE-2010-1679...

UBUNTU-CVE-2010-4651

Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is specified with a .. dot dot or full pathname, a related issue to CVE-2010-1679...

PT-2011-2809

Name of the Vulnerable Software and Affected Versions Ruby versions 1.8.6 through 1.8.6-420 Ruby versions 1.8.7 through 1.8.7-330 Ruby version 1.8.8dev Description The safe-level feature in Ruby allows context-dependent attackers to modify strings via the Exceptionto s method. This could be used ...

Path traversal

Absolute path traversal vulnerability in the org.debian.apt.UpdateCachePartially method in worker.py in Aptdaemon 0.40 in Ubuntu 10.10 and 11.04 allows local users to read arbitrary files via a full pathname in the sourceslist argument, related to the D-Bus interface...

CVE-2011-0725

Absolute path traversal vulnerability in the org.debian.apt.UpdateCachePartially method in worker.py in Aptdaemon 0.40 in Ubuntu 10.10 and 11.04 allows local users to read arbitrary files via a full pathname in the sourceslist argument, related to the D-Bus interface...

CVE-2011-1005 Ruby: Untrusted codes able to modify arbitrary strings

The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exceptiontos method, as demonstrated by changing an intended pathname...

CVE-2011-0922

The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXECSETUP command that references a UNC share pathname...

CVE-2011-0922

The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXECSETUP command that references a UNC share pathname...

CVE-2011-0922: Improper Input Validation

The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXECSETUP command that references a UNC share pathname...

CVE-2011-0912

Argument injection vulnerability in IBM Lotus Notes 8.0.x before 8.0.2 FP6 and 8.5.x before 8.5.1 FP5 allows remote attackers to execute arbitrary code via a cai:// URL containing a --launcher.library option that specifies a UNC share pathname for a DLL file, aka SPR PRAD82YJW2...

PT-2011-2765

Name of the Vulnerable Software and Affected Versions HP Data Protector affected versions not specified Description The issue allows remote attackers to execute arbitrary programs via an EXEC SETUP command that references a UNC share pathname. This can lead to remote code execution. Recommendatio...

SuSE 10 Security Update : cvs (ZYPP Patch Number 7302)

cvs fails with 'invalid pathname' error when using relative paths. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid51638; scriptversion"1.7...