The vulnerability of the microprogramming software of the presentation server Crestron AirMedia AM-100 allows a intruder to execute arbitrary commands.

The vulnerability of the bin/rftest.cgi file in the Crestron AirMedia AM-100 presentation server’s microprogramming software is related to deficiencies in pathname restriction. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands via the ATEcommand parameter...

CVE-2016-7133

Zend/zendalloc.c in PHP 7.x before 7.0.10, when openbasedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service integer overflow or possibly have unspecified other impact via a long pathname...

CVE-2016-7133

Zend/zendalloc.c in PHP 7.x before 7.0.10, when openbasedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service integer overflow or possibly have unspecified other impact via a long pathname...

PT-2016-7230

Name of the Vulnerable Software and Affected Versions PHP versions prior to 7.0.10 Description The issue is related to a mishandling of huge realloc operations in the zend alloc.c file when open basedir is enabled. This can be exploited by remote attackers using a long pathname, potentially causi...

UBUNTU-CVE-2016-7133

Zend/zendalloc.c in PHP 7.x before 7.0.10, when openbasedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service integer overflow or possibly have unspecified other impact via a long pathname...

CVE-2016-6369

Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464...

iPass Open Mobile Remote Code Execution Vulnerability - Windows

iPass Open Mobile is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-1183: Undefined Security Weakness

NTT Data TERASOLUNA Server Framework for JavaWEB 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname...

CVE-2016-4532

Directory traversal vulnerability in the WAP interface in Trihedral VTScada formerly VTS 8.x through 11.x before 11.2.02 allows remote attackers to read arbitrary files via a crafted pathname...

Directory traversal

Directory traversal vulnerability in the WAP interface in Trihedral VTScada formerly VTS 8.x through 11.x before 11.2.02 allows remote attackers to read arbitrary files via a crafted pathname...

Design/Logic Flaw

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the streamresolveincludepath function in ext/standard/streamsfuncs.c, as...

Design/Logic Flaw

PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls 1 a DOMDocument save method or 2 the GD imagepsloadfont function...

CVE-2015-3411

The CVE-2015-3411 issue affects PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 where pathnames could include a NULL character (\0). This allows remote attackers to read or write arbitrary files via crafted input in calls such as DOMDocument::load, xmlwriter_open_uri, finfo_file, o...

Google Chrome download operation bypasses security restrictions vulnerability

Google Chrome is a web browsing tool developed by Google. A security vulnerability exists in the download implementation of Google Chrome prior to version 50.0.2661.75, which allows remote attackers to bypass the target pathname restriction...

CVE-2016-1656

The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors...

CVE-2016-1656

The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors...

CVE-2016-1656

The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors...

UBUNTU-CVE-2016-1656

The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors...

CVE-2016-1656

The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors...

CVE-2016-1656

The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors...