Exploit for CVE-2017-8570

This repository contains a Proof of Concept PoC exploit for CVE-2017-8570, a vulnerability in Microsoft Office that allows an attacker to execute arbitrary code by embedding a malicious script in a Rich Text Format RTF file. The exploit uses the "Packager.dll" file-dropping trick to drop a ".sct"...

CVE-2018-5731

An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP. Afterwards the executable is run. It is possible for an attacker to create the file first, let md.hs overwrite it, and then rewrite the...

CVE-2018-5731

An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP. Afterwards the executable is run. It is possible for an attacker to create the file first, let md.hs overwrite it, and then rewrite the...

PT-2018-17116

Name of the Vulnerable Software and Affected Versions: Heimdal PRO version 2.2.190 Description: An issue in Heimdal PRO allows an attacker to exploit a vulnerability related to the scanning feature. The md.hs process writes an executable called CS1.tmp to C:windowsTEMP and then runs it. An attack...

CVE-2018-6944

core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...

PT-2018-17834

Name of the Vulnerable Software and Affected Versions UltimateMember plugin version 2.0 Description The issue arises from a cross-site scripting vulnerability in the core/lib/upload/um-file-upload.php file of the UltimateMember plugin. This vulnerability occurs because the plugin fails to properl...

Code injection

IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532...

CVE-2017-1711

IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532...

CVE-2017-1711

IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532...

PT-2018-6402

Name of the Vulnerable Software and Affected Versions: IBM iNotes versions 8.5 through 9.0 Description: The issue allows malicious code to be executed by masquerading as a Windows DLL in the temp directory, which can be run by the SUService. Recommendations: For IBM iNotes versions 8.5 through 9....

CVE-2017-1711: Untrusted Search Path

IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 134532...

Ubuntu 14.04 LTS / 16.04 LTS : PostgreSQL vulnerability (USN-3564-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3564-1 advisory. It was discovered that PostgreSQL incorrectly handled certain temp files. An attacker could possibly use this to access sensitive information. Tenable...

CVE-2014-3219

fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on 1 /tmp/fishd.log.%s, 2 /tmp/.pac-cache.$USER, 3 /tmp/.yum-cache.$USER, or 4 /tmp/.rpm-cache.$USER...

USN-3564-1 postgresql-9.3, postgresql-9.5, postgresql-9.6 vulnerability

It was discovered that PostgreSQL incorrectly handled certain temp files. An attacker could possibly use this to access sensitive information...

USN-3564-1: PostgreSQL vulnerability

It was discovered that PostgreSQL incorrectly handled certain temp files. An attacker could possibly use this to access sensitive information...

ALPINE-CVE-2018-6198

w3m through 0.5.3 does not properly handle temporary files when the /.w3m directory is unwritable, which allows a local attacker to craft a symlink attack to overwrite arbitrary files...

I, Librarian Reflective Cross-Site Scripting Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. A cross-site scripting vulnerability exists in the temp.php file in Scilico I, Librarian versions 4.6 and earlier and 4.7. A remote attacker can exploit the vulnerability to inject malicious...

CVE-2017-16560

The SanDisk Secure Access 3.01 vault may decrypt and copy encrypted files to a temporary folder, leaving plaintext copies on disk indefinitely in certain scenarios (e.g., when editing a file or after a crash). This stems from temporary plaintext files retained on disk. Affected product: SanDisk S...

CVE-2017-1346

IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan. IBM X-Force ID: 126461...

OneThink Frontend Cache Mechanism Has Design Flaw Vulnerability

OneThink is an open source content management framework developed by ThinkPHP team based on ThinkPHP. OneThink front-end caching mechanism has a design flaw vulnerability. Since the program caches registered usernames to a cache file in the temp directory, and the cache file has executable...