CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8297
https://notcve.org/view.php?id=CVE-2017-8297
A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole "Simple PHP File Manager" component). Existe una vulnerabilidad de salto de directorio en el gestor de archivos Simple PHP File Manager anterior al 26-04-2017, que afecta a index.php (el único componente de "Simple PHP File Manager"). • https://github.com/jcampbell1/simple-file-manager/commit/de52e7ee61a842d8fdf791f2a5b7c91b6c5cdb56 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 1CVE-2016-7162
https://notcve.org/view.php?id=CVE-2016-7162
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive. La función _g_file_remove_directory en file-utils.c en File Roller 3.5.4 hasta la versión 3.20.2 permite a atacantes remotos eliminar archivos arbitrarios a través de un ataque de enlace simbólico en una carpeta en un archivo. • http://ftp.gnome.org/mirror/gnome.org/sources/file-roller/3.20/file-roller-3.20.3.news http://ftp.gnome.org/mirror/gnome.org/sources/file-roller/3.21/file-roller-3.21.90.news http://www.openwall.com/lists/oss-security/2016/09/08/4 http://www.securityfocus.com/bid/92896 http://www.ubuntu.com/usn/USN-3074-1 https://bugzilla.gnome.org/show_bug.cgi?id=698554 https://git.gnome.org/browse/file-roller/commit/?id=f70be1f41688859ec8dbe266df35a1839ceb96c5 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2015-7747
https://notcve.org/view.php?id=CVE-2015-7747
Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted audio file, as demonstrated by sixteen-stereo-to-eight-mono.c. Un desbordamiento del búfer en la función afReadFrames en audiofile (también se conoce como libaudiofile and Audio File Library), permite a atacantes remotos asistidos por el usuario causar una denegación de servicio (bloqueo del programa) o posiblemente ejecutar código arbitrario por medio de un archivo de audio diseñado, como es demostrado por el archivo sixteen-stereo-to-eight-mono.c • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170387.html http://www.openwall.com/lists/oss-security/2015/10/06/2 http://www.ubuntu.com/usn/USN-2787-1 https://bugs.launchpad.net/ubuntu/+source/audiofile/+bug/1502721 https://github.com/ccrisan/motioneyeos/blob/master/package/audiofile/0008-CVE-2015-7747.patch https://www.openwall.com/lists/oss-security/2015/10/08/1 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2015-4379
https://notcve.org/view.php?id=CVE-2015-4379
Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors. Vulnerabilidad de CSRF en el módulo Webform Multiple File Upload 6.x-1.x anterior a 6.x-1.3 y 7.x-1.x anterior a 7.x-1.3 para Drupal permite a atacantes remotos secuestrar la autenticación de ciertos usuarios para solicitudes que eliminan ficheros a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2015/04/25/6 http://www.securityfocus.com/bid/74343 https://www.drupal.org/node/2459031 https://www.drupal.org/node/2459035 https://www.drupal.org/node/2459323 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 4%CPEs: 49EXPL: 0CVE-2014-9653 – file: malformed elf file causes access to uninitialized memory
https://notcve.org/view.php?id=CVE-2014-9653
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file. readelf.c en file anterior a 5.22, utilizado en el componente Fileinfo en PHP anterior a 5.4.37, 5.5.x anterior a 5.5.21, y 5.6.x anterior a 5.6.5, no considera que las llamadas a pread a veces leen solamente un subjuego de los datos disponibles, lo que permite a atacantes remotos causar una denegación de servicio (acceso a memoria no inicializada) o posiblemente tener otro impacto a través de un fichero ELF manipulado. A flaw was found in the way the File Information (fileinfo) extension parsed Executable and Linkable Format (ELF) files. A remote attacker could use this flaw to cause a PHP application using fileinfo to crash or disclose certain portions of server memory. • http://bugs.gw.com/view.php?id=409 http://marc.info/?l=bugtraq&m=143748090628601&w=2 http://marc.info/?l=bugtraq&m=144050155601375&w=2 http://mx.gw.com/pipermail/file/2014/001649.html http://openwall.com/lists/oss-security/2015/02/05/13 http://php.net/ChangeLog-5.php http://rhn.redhat.com/errata/RHSA-2016-0760.html http://www.debian.org/security/2015/dsa-3196 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www&# • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •