SUSE-SU-2018:3230-1 Security update for xen

This update for xen fixes several issues. These security issues were fixed: - CVE-2018-8897: Prevent mishandling of debug exceptions on x86 XSA-260, bsc1090820 - Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially...

Blynk blynk-server path traversal vulnerability

Blynk is an application for controlling Arduino and Raspberry Pi. blynk-server is one of the server components. A directory traversal vulnerability exists in blynk-server in versions of Blynk prior to 0.39.7. An attacker can exploit this vulnerability with a URL with '... /' and the URL starts wi...

Agentejo Cockpit Directory Traversal Vulnerability

Agentejo Cockpit is a management system for managing structured content on websites. A directory traversal vulnerability exists in Agentejo Cockpit version 0.6.2, which arises from a program that does not properly validate a file before performing operations on it. An attacker can exploit the...

CVE-2018-15540

Agentejo Cockpit exposes a Directory Traversal vulnerability (CVE-2018-15540) due to insufficient validation when performing file operations via the /cockpit/media/api interface. The CNVD entry notes a traversal path allowing an attacker to move the filesystem and access arbitrary files in Cockpi...

USN-3773-1 ghostscript vulnerabilities

It was discovered that Ghostscript contained multiple security issues. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use these issues to access arbitrary files, execute arbitrary code, or cause a denial of service...

Jekyll allows attackers to access arbitrary files by specifying a symlink

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the include key in the config.yml file...

Jekyll Arbitrary File Access Vulnerability

Jekyll is a static website generator. A security vulnerability exists in Jekyll version 3.6.2 and earlier, version 3.7.x through 3.7.3, and version 3.8.x through 3.8.3. An attacker can exploit the vulnerability by specifying a symbolic link in the 'include' key of the 'config.yml' file to access...

CVE-2018-17567

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "config.yml" file...

Arbitrary File Read And Write

org.apache.karaf.shell.core is vulnerable to arbitrary file read and write. A user with rights to the Karaf console is able to read or write any file on the file system, which would allow an attacker with access to the sshd service to abuse the vulnerability to read or write arbitrary files on th...

Apache Camel Mail Path Traversal Vulnerability

Apache Camel is the United States Apache Apache Software Foundation of a set of open source based on Enterprise Integration Pattern Enterprise Integration Pattern , referred to as EIP integration framework. The framework provides Enterprise Integration Pattern of Java objects POJO implementation ...

CVE-2018-16288

LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs...

Cybozu Garoon Path Traversal Vulnerability

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin boards, document management, and other functions, and supports free switching among three languages Chinese, Japanese, and English. A path traversal vulnerability...

taoCMS V2.5Beta5 has arbitrary file reading vulnerability

TAOCMS is the smallest fully functional CMS management system in China based on php+sqlite/mysql. taoCMS V2.5Beta5 has an arbitrary file reading vulnerability, which can be exploited by an attacker to read, download and edit all files of the site...

CVE-2017-9000

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An...

Design/Logic Flaw

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An...

CVE-2017-9000

CVE-2017-9000 affects ArubaOS on multiple branches (pre-6.3.1.25, pre-6.4.4.16, pre-6.5.1.9/6.5.2/6.5.3/6.5.4, and pre-8.1.0.4). It describes an unauthenticated arbitrary file access vulnerability that can be exploited by an unauthenticated attacker with network access to an Aruba Mobility Contro...

CVE-2017-9000

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An...

USN-3730-1: LXC vulnerability

Matthias Gerstner discovered that LXC incorrectly handled the lxc-user-nic utility. A local attacker could possibly use this issue to open arbitrary files...

USN-3730-1 lxc vulnerability

Matthias Gerstner discovered that LXC incorrectly handled the lxc-user-nic utility. A local attacker could possibly use this issue to open arbitrary files...

File Inclusion Vulnerability in aitecms V1.0

Hainan Zanzan Network Technology Co., Ltd. is a network company in the industry that provides professional website construction, network service and operation technology output. aitecms V1.0 has a file inclusion vulnerability that can be exploited by attackers to access arbitrary files...