w3m Arbitrary File Overwrite Vulnerability

w3m is an open source text-based Web browser . A security vulnerability exists in w3m 0.5.3 and earlier versions, which stems from the program failing to properly handle temporary files. A local attacker can exploit this vulnerability by performing a symbolic link attack to overwrite arbitrary...

w3m - multiple vulnerabilities

Tatsuya Kinoshita reports: CVE-2018-6196 table.c: Prevent negative indent value in feedtableblocktag. CVE-2018-6197 form.c: Prevent invalid columnPos call in formUpdateBuffer. CVE-2018-6198 config.h.dist, config.h.in, configure, configure.ac, main.c, rc.c: Make temporary directory safely when /.w...

Red Hat keycloak-httpd-client-install file overwrite vulnerability

Red Hat keycloak is a suite of software from Red Hat that provides authentication and management capabilities for modern applications and services. keycloak-httpd-client-install is an executable installer. A security vulnerability exists in Red Hat keycloak-httpd-client-install that stems from th...

UBUNTU-CVE-2018-6198

w3m through 0.5.3 does not properly handle temporary files when the /.w3m directory is unwritable, which allows a local attacker to craft a symlink attack to overwrite arbitrary files...

GHSA-6X45-86Q6-RCMR Gyazo allows local users to write arbitrary files

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...

CVE-2017-15111

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link...

CVE-2017-15111

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link...

CVE-2017-15111

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link...

PT-2018-5348 · Rails · Delayed Job Web

Name of the Vulnerable Software and Affected Versions: delayed job web rails gem versions 1.2.9 through 1.4 Description: An exploitable cross site scripting XSS issue exists in the filter functionality. A specially crafted URL can cause an XSS flaw, allowing an attacker to execute arbitrary...

PT-2018-3241

Name of the Vulnerable Software and Affected Versions libcurl versions 7.1 through 7.57.0 Description The issue is related to insufficient protection of registration data in the libcurl library. This could allow a remote attacker to gain unauthorized access to protected information. When libcurl ...

PT-2018-3641 · Openssl +11 · Openssl +11

Name of the Vulnerable Software and Affected Versions: OpenSSL versions 1.1.1 through 1.1.1j MySQL Server versions 5.7.33 and earlier, 8.0.23 and earlier Description: The issue is related to a NULL pointer dereference in OpenSSL TLS servers when a maliciously crafted renegotiation ClientHello...

Design/Logic Flaw

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...

Race condition

Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed...

CVE-2014-4994

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...

CVE-2014-4995

Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed...

CVE-2014-4995

Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed...

Mail.ru: XSS в теле письма.

XSS via malcrafted HTML "rel" attribute. As a temporary workaround rel attribute was disabled on the day of reporting. A final solution fixes parsing algorithm for rel attributes...

Command injection vulnerability

VladTheEnterprising Gem for Ruby contains a flaw as the program creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the /tmp/my.cnf.targethost file they can overwrite arbitrary files, gain access to the MySQL root password, or inject arbitrary...

CVE-2014-1859

1 core/tests/testmemmap.py, 2 core/tests/testmultiarray.py, 3 f2py/f2py2e.py, and 4 lib/tests/testio.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file...

PYSEC-2018-34

1 core/tests/testmemmap.py, 2 core/tests/testmultiarray.py, 3 f2py/f2py2e.py, and 4 lib/tests/testio.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file...