CVE

Id
91179  
CVE No.
CVE-2016-4360  
Status
Candidate  
Description
web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 do not restrict file paths sent to an unlink call, which allows remote attackers to delete arbitrary files via the path parameter to data/import_csv, aka ZDI-CAN-3555.  
Phase
Assigned (20160429)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
783835 91179 CVE-2016-4360 MISC:http://www.zerodayinitiative.com/advisories/ZDI-16-364  View
783836 91179 CVE-2016-4360 MISC:http://www.tenable.com/security/research/tra-2016-17  View
783837 91179 CVE-2016-4360 CONFIRM:https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05157423  View
783838 91179 CVE-2016-4360 BID:90975  View
783839 91179 CVE-2016-4360 URL:http://www.securityfocus.com/bid/90975  View
783840 91179 CVE-2016-4360 SECTRACK:1036006  View

Related JVN