CVE-2010-1693

openibd in OpenFabrics Enterprise Distribution OFED 1.5.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ibsetnodedesc.sh temporary file...

CVE-2010-3264

The engine installer in Novell Identity Manager aka IDM 3.6.1 stores admin tree credentials in /tmp/idmInstall.log, which allows local users to obtain sensitive information by reading this file...

Design/Logic Flaw

The engine installer in Novell Identity Manager aka IDM 3.6.1 stores admin tree credentials in /tmp/idmInstall.log, which allows local users to obtain sensitive information by reading this file...

CVE-2010-3264

The CVE-2010-3264 entry affects Novell Identity Manager (IDM) 3.6.1: the engine installer writes admin tree credentials to /tmp/idmInstall.log, exposing sensitive information to any local user who reads that file. This is a local-privilege-exposure issue rooted in the installer’s handling of cred...

Fedora 13 : gource-0.24-3.fc13 (2010-6703)

Randomize name for files created in /tmp Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Fedora 12 : gource-0.24-3.fc12 (2010-6766)

Randomize name for files created in /tmp Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

CVE-2010-2024

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/...

linux/x86 sys_mkdir("/tmp/dir",1) shellcode 38 bytes

Exploit for linux/x86 platform in category shellcode ==================================================== linux/x86 sysmkdir"/tmp/dir",1 shellcode 38 bytes ==================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ ...

Linux/x86 - rmdir(/tmp/willdeleted) Shellcode (41 bytes)

Linux/x86 - rmdir/tmp/willdeleted Shellcode 41 bytes. Shellcode exploit for Linuxx86 platform / Name : 41 bytes sysrmdir"/tmp/willdeleted" x86 linux shellcode Date : may, 31 2010 Author : gunslinger Web : devilzc0de.com blog : gunslingerc0de.wordpress.com tested on : linux debian...

CVE-2010-2027

Mathematica 7, when running on Linux, allows local users to overwrite arbitrary files via a symlink attack on 1 files within /tmp/MathLink/ or 2 /tmp/fonts$$.conf...

CVE-2010-2027

Mathematica 7, when running on Linux, allows local users to overwrite arbitrary files via a symlink attack on 1 files within /tmp/MathLink/ or 2 /tmp/fonts$$.conf...

CVE-2010-1438

CVE-2010-1438 affects Web Application Finger Printer (WAFP) 0.01-26c3, which uses fixed /tmp pathnames for temporary files and directories. The root cause is improper handling of /tmp paths, enabling local users to: (1) cause a denial of service by pre-creating a file with an expected pathname, (...

List Files with setuid-bit in / and /home, Check /tmp for sticky-bit

This plugin uses SSH to list files with setuid-bit in / and /home, check /tmp for sticky-bit. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Solaris Update Manager / Sun Patch Cluster Symlink Attack

Symlink attack with Solaris Update manager and Sun Patch Cluster Larry W. Cashdollar Vapid Labs http://vapid.dhs.org 1/24/2010 With the GUI Sun Update Manager being used to install patches on a system local users can easily run scripts and create symlinks in an attempt to clobber files and...

CVE-2009-1299

The pamakesecuredir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd- temporary file...

Firefox: Predictable /tmp pathname use

Mozilla Firefox 3.6a1, 3.5.3, 3.5.2, and earlier 3.5.x versions, and 3.0.14 and earlier 2.x and 3.x versions, on Linux uses a predictable /tmp pathname for files selected from the Downloads window, which allows local users to replace an arbitrary downloaded file by placing a file in a /tmp locati...

CVE-2010-0424

The editcmd function in crontab.c in 1 cronie before 1.4.4 and 2 Vixie cron vixie-cron allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory...

Phpwind7.5 后台本地包含漏洞

文件：hack\rate\admin.php 源码： ?php !functionexists'readover' && exit'Forbidden'; define "HR", RP . "hack/rate/" ; define "LR", RP . "lib/" ; InitGP array 'ajax' ; $action = strtolower $job ? $job : "admin" ; $filepath = HR . "action/" . $action . "Action.php"; ! fileexists $filepath && exit ; if $jo...

linux/x86 cp /bin/sh /tmp/katy

No description provided by source. / Linux/x86 /bin/cp /bin/sh /tmp/katy ; chmod 4555 /tmp/sh using fork / include stdio.h char shellcode = "\xeb\x5e\x5f\x31\xc0\x88\x47\x07\x88\x47\x0f\x88\x47\x19\x89\x7f" "\x1a\x8d\x77\x08\x89\x77\x1e\x31\xf6\x8d\x77\x10\x89\x77\x22\x89"...

Unrestricted file upload

Unrestricted file upload vulnerability in ofcuploadimage.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when registerglobals is enabled, allows remote authenticated users to...