Arkeia Network Backup Client 5.x contains hard-coded credentials that effectively serve as a back door, which allows remote attackers to access the file system and possibly execute arbitrary commands.
SQL injection vulnerability in shop/detail.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to execute arbitrary SQL commands via the id parameter.
Cross-site scripting (XSS) vulnerability in function/sideblock.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to inject arbitrary web script or HTML via the sideblock4 parameter.
Directory traversal vulnerability in user/header.php in Affiliate Market 0.1 BETA allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
Directory traversal vulnerability in arias/help/effect.php in aria 0.99-6 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
The Atme (aka com.bedigital.atme) application 1.0.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
It was reported [1] that arc is susceptible to directory traversal. Original report: ... $ pwd /home/jwilk
$ arc x traversal.arc Extracting file: /tmp/moo
$ ls -l /tmp/moo -rw-r--r-- 1 jwilk users 4 Jan 4 2015 /tmp/moo
The script I used to create the test case is available at: https://bitbucket.org/jwilk/path-traversal-samples ...
No patches available at this time.
[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774527