1658 matches found
CVE-2018-16539: Exposure of Sensitive Information to an Unauthorized Actor
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable...
GHSA-XRR4-74MC-RPJC Pyro mishandles pid files in temporary directory locations and opening the pid file as root
pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks...
Starbucks: Backup Source Code Detected
Impact Depending on the nature of the source code disclosed, an attacker can mount one or more of the following types of attacks:•Access the database or other data resources. With the privileges of the account obtained, attempt to read, update or delete arbitrary data from the database. •Access...
Inteno IOPSYS - (Authenticated) Local Privilege Escalation Exploit
Exploit for linux platform in category local exploits !/usr/bin/python import json import sys import subprocess import socket import os from websocket import createconnection def ubusAuthhost, username, password: ws = createconnection"ws://" + host, header = "Sec-WebSocket-Protocol: ubus-json" re...
Directory traversal
On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector...
PT-2018-5076
Name of the Vulnerable Software and Affected Versions SecureConnector agent affected versions not specified Description The SecureConnector agent runs under the local SYSTEM account and executes plugin scripts and executables on the endpoint to gather and report information to the CounterACT...
CVE-2018-7884
An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl1956.exe is run as SYSTEM on the %systemroot%\Temp folder, where any user can write a DLL...
CVE-2018-7884: Untrusted Search Path
An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl1956.exe is run as SYSTEM on the %systemroot%\Temp folder, where any user can write a DLL...
PT-2018-18305
Name of the Vulnerable Software and Affected Versions: DisplayLink Core Software Cleaner Application version 8.2.1956 Description: An issue was discovered in the DisplayLink Core Software Cleaner Application. When the drivers are updated to a newer version, the product launches a process as SYSTE...
Phabricator: The "Download Raw Diff" URL is viewable by everyone
mongoose This is similar to 213942, but less severe. Here is what you said in 213942: The change makes us write files with narrow permissions instead of broad permissions, write temporary files instead of permanent files and ... If I understand your comment correctly, suppose that an Administrato...
Unrestricted file upload
Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directory under the document...
Mediawiki Arbitrary Code Execution Vulnerability
MediaWiki is a free and free web-based Wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers, which can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in Mediawiki versions prior to 1.28.1 and pri...
Exploit for CVE-2017-8570
This repository contains a Proof of Concept PoC exploit for CVE-2017-8570, a vulnerability in Microsoft Office that allows an attacker to execute arbitrary code by embedding a malicious script in a Rich Text Format RTF file. The exploit uses the "Packager.dll" file-dropping trick to drop a ".sct"...
CVE-2018-5731
An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP. Afterwards the executable is run. It is possible for an attacker to create the file first, let md.hs overwrite it, and then rewrite the...
CVE-2018-5731
An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp to C:\windows\TEMP. Afterwards the executable is run. It is possible for an attacker to create the file first, let md.hs overwrite it, and then rewrite the...
PT-2018-17116
Name of the Vulnerable Software and Affected Versions: Heimdal PRO version 2.2.190 Description: An issue in Heimdal PRO allows an attacker to exploit a vulnerability related to the scanning feature. The md.hs process writes an executable called CS1.tmp to C:windowsTEMP and then runs it. An attack...
CVE-2018-6944
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...
PT-2018-17834
Name of the Vulnerable Software and Affected Versions UltimateMember plugin version 2.0 Description The issue arises from a cross-site scripting vulnerability in the core/lib/upload/um-file-upload.php file of the UltimateMember plugin. This vulnerability occurs because the plugin fails to properl...