PT-2013-5756

Name of the Vulnerable Software and Affected Versions phpBB3 versions prior to 3.0.11-4 Description The issue allows local users to modify cache file contents due to world-writable permissions. Recommendations For versions prior to 3.0.11-4, update to version 3.0.11-4 or later to resolve the issu...

CVE-2013-4216: Undefined Security Weakness

The TraceOpenLogFile function in InfraStack/OSDependent/Linux/InfraStackModules/TraceModule/TraceModule.c in the Trace module in the Intel WiMAX Network Service through 1.5.2 for Intel Wireless WiMAX Connection 2400 devices uses world-writable permissions for wimaxd.log, which allows local users ...

[LinEnum] Scripted Local Linux Enumeration & Privilege Escalation Checks

High-level summary of the checks/tasks performed by LinEnum: Kernel and distribution release details System Information: Hostname Networking details: Current IP Default route details DNS server information User Information: Current user details Last logged on users List all users including uid/gi...

Fedora 18 : file-roller-3.6.4-1.fc18 (2013-12653)

This update fixes CVE-2013-4668 : The File Roller archive manager for the GNOME desktop suffers from a path traversal vulnerability caused by insufficient path sanitization. A specially crafted archive file can be used to trigger creation of arbitrary files in any location, writable by the user...

Oracle Linux 5 : acpid (ELSA-2009-1642)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-1642 advisory. 1.0.4-9.el54.1 - Resolves: 515062 CVE-2009-4033 acpid: log file created with random permissions Tenable has extracted the preceding description block directly...

DEBIAN-CVE-2013-2203

WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message...

Updated qemu packages fix security vulnerability

It was found that QEMU Guest Agent the "qemu-ga" service created certain files with world-writable permissions when run in daemon mode the default mode. An unprivileged guest user could use this flaw to consume all free space on the partition containing the qemu-ga log file, or modify the content...

MGASA-2013-0169 Updated qemu packages fix security vulnerability

It was found that QEMU Guest Agent the "qemu-ga" service created certain files with world-writable permissions when run in daemon mode the default mode. An unprivileged guest user could use this flaw to consume all free space on the partition containing the qemu-ga log file, or modify the content...

CentOS Update for qemu-guest-agent CESA-2013:0896 centos6

Check for the Version of qemu-guest-agent OpenVAS Vulnerability Test CentOS Update for qemu-guest-agent CESA-2013:0896 centos6 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/o...

qemu security update

CentOS Errata and Security Advisory CESA-2013:0896 Updated qemu-kvm packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring Syste...

PT-2013-4435

Name of the Vulnerable Software and Affected Versions GroundWork Monitor Enterprise version 6.7.0 Description The issue concerns the Foundation webapp admin interface in GroundWork Monitor Enterprise, where it uses the nagios account as the owner of writable files under /usr/local/groundwork. Thi...

Code injection

The installer routine in Schneider Electric MiCOM S1 Studio uses world-writable permissions for executable files, which allows local users to modify the service or the configuration files, and consequently gain privileges or trigger incorrect protective-relay operation, via a Trojan horse...

CVE-2013-0687

The installer routine in Schneider Electric MiCOM S1 Studio uses world-writable permissions for executable files, which allows local users to modify the service or the configuration files, and consequently gain privileges or trigger incorrect protective-relay operation, via a Trojan horse...

CVE-2013-0687: Undefined Security Weakness

The installer routine in Schneider Electric MiCOM S1 Studio uses world-writable permissions for executable files, which allows local users to modify the service or the configuration files, and consequently gain privileges or trigger incorrect protective-relay operation, via a Trojan horse...

PT-2013-2532

Name of the Vulnerable Software and Affected Versions Schneider Electric MiCOM S1 Studio affected versions not specified Description The issue concerns the installer routine of the software, which uses world-writable permissions for executable files. This allows local users to modify the service ...

BigAnt Server 2.97 - DDNF 'Username' Remote Buffer Overflow

!/usr/bin/python Title: BigAnt Server 2.97 DDNF Username Buffer Overflow Author: Craig Freyman @cd1zz http://pwnag3.com Tested on: Windows 7 64 bit DEP/ASLR Bypass Similar Exploits: http://www.exploit-db.com/exploits/24528/ http://www.exploit-db.com/exploits/24527/...

CVE-2013-0798

CVE-2013-0798 affects Firefox for Android. The issue is that the app_tmp directory used during addon installation is world-writable and world-readable, allowing an attacker to replace or modify addons during the window when they are staged before installation. This is specific to Firefox for Andr...

CVE-2013-0798

Mozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the apptmp installation directory in the local filesystem, which allows attackers to modify add-ons before installation via an application that leverages the time window during which apptmp is used...

PT-2013-2625

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 20.0 on Android Description The issue allows attackers to modify add-ons before installation by leveraging the time window during which the app tmp directory is used, due to world-writable and world-readable...

CVE-2013-0798: Undefined Security Weakness

Mozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the apptmp installation directory in the local filesystem, which allows attackers to modify add-ons before installation via an application that leverages the time window during which apptmp is used...