GlassFish Server - Arbitrary File Read

GlassFish Server - Arbitrary File Read Title: glassfish Arbitrary file read vulnerability Date : 01/15/2016 Author: bingbing Software link: https://glassfish.java.net/download.html Software: GlassFish Server Tested: Linux x86 !/usr/bin/python import urllib2...

Vulnerability warning: the application server glassfish arbitrary file read vulnerability-vulnerability warning-the black bar safety net

1 http://localhost:4848/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd java voice will put the"%c0%ae"resolved to"\uC0AE",and finally escape to ASCCII character"." Point. Jane simple singl...

GlassFish Server - Arbitrary File Read

Exploit for java platform in category web applications Title: glassfish Arbitrary file read vulnerability Date : 01/15/2016 Author: bingbing Software link: https://glassfish.java.net/download.html Software: GlassFish Server Tested: Linux x86 !/usr/bin/python import urllib2...

GlassFish Arbitrary File Read Vulnerability

GlassFish is a JavaEE5-based business-compatible application server for development, deployment and redistribution. GlassFish suffers from an arbitrary file read vulnerability. Due to its implementation of unicode encoding flaws, resulting in multiple parsing of the same code, such as: java...

GlassFish Server - Arbitrary File Read

Title: glassfish Arbitrary file read vulnerability Date : 01/15/2016 Author: bingbing Software link: https://glassfish.java.net/download.html Software: GlassFish Server Tested: Linux x86 !/usr/bin/python import urllib2...

CVE-2016-1897

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...

GlassFish 任意文件读取漏洞

java把"%c0%ae"解析为"\uC0AE"，最后转义为ASCCII字符"." 访问如下链接即可看到效果： http://localhost:4848/theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd 参考链接： 《漏洞预警：应用服务器glassfish任意文件读取漏洞》 !/usr/bin/env python coding...

Z-BLOG Blind-XXE造成任意文件读取

No description provided by source...

ownCloud Arbitrary File Read Vulnerability

OwnCloud is a free and open source personal cloud storage solution from German company OwnCloud. The solution offers file management, music storage, calendars and more. A security vulnerability exists in ownCloud. A remote attacker can exploit the vulnerability to read arbitrary files in the...

Arbitrary File Read Vulnerability in Xfire Java Web Services Engine

XFire is a new generation of Java Web services engine . Xfire Java Web Service Engine has an arbitrary file read vulnerability, which uses STAX to parse XML during invoke resulting in XML entity injection, which can be exploited by an attacker to read arbitrary files...

Joomla! directory traversal vulnerability (CNVD-2015-08378)

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. The system provides RSS feeds , site search and other functions . A directory traversal vulnerability exists in Joomla! versions 3.4.x before 3.4.6. A remote attacker can exploit th...

Joomla Shape 5 MP3 Player 2.0 Plugin 任意文件读取漏洞

No description provided by source...

Kodi 15 - Arbitrary File Aaccess (Web Interface) Vulnerability

Kodi 15 reintroduced an arbitrary file access vulnerability. Exploit Title: arbitrary file access kodi web interface Shodan dork: title:kodi Date: 25-11-2015 Contact: https://twitter.com/mpronk89 Software Link: http://kodi.tv/ Original report:...

Cisco Firepower 9000 Series存在多个任意文件读取漏洞

No description provided by source...

SAP Mobile Platform 2.3 XXE Injection Vulnerability

SAP Mobile Platform version 2.3 suffers from an XML external entity injection vulnerability Application: SAP Mobile Platform 2.3 Versions Affected: SAP Mobile Platform 2.3, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 25.02.2015 Reported: 25.02.2015 Vendor response:...

TRS portal个性化门户任意文件读取(二)

简要描述： 发现portal个性化门户其他链接实体注入漏洞 详细说明： TRS Portal个性化门户 http://XX.XX.XX.XX/portal/help/wcmhelpaddeditdowith.jsp链接未对外部实体进行过滤，可调用外部实体进行解析，可任意读取服务器上任意文件 漏洞证明： 漏洞利用过程： http://XX.XX.XX.XX/portal/help/wcmhelpaddeditdowith.jsp POST请求：ObjectXML=%0d%0a%20%20%25remote;%0d%0a%5D%0d%0a...

ZTE ZXHN H108N R1A ZXV10 W300 Routers - Multiple Vulnerabilities

ZTE ZXHN H108N R1A ZXV10 W300 Routers - Multiple Vulnerabilities Exploit Title: ZTE ZXHN H108N R1A + ZXV10 W300 routers - multiple vulnerabilities Discovered by: Karn Ganeshen CERT VU 391604 Vendor Homepage: www.zte.com.cn Versions Reported ZTE ZXHN H108N R1A - Software version ZTE.bhs.ZXHNH108NR...

Multiple Arbitrary File Read Vulnerabilities in Cisco Firepower 9000 Series

Cisco Firepower 9000 is a set of Cisco Cisco running in the 9000 series of firewall devices in the operating system. Multiple arbitrary file read vulnerabilities exist in the Cisco Firepower 9000 Series. This vulnerability could be exploited by an attacker to read arbitrary files on an affected...

Cisco Firepower 9000 Arbitrary File Read Access Script Vulnerability

A vulnerability in a user script supplied with Cisco Firepower 9000 devices could allow an authenticated, remote attacker to view any file on the device, even ones that should be restricted to authenticated users. The vulnerability is due to lack of input validation of the parameters passed to...

ZTE ZXHN H108N R1A Arbitrary File Read Vulnerability

The ZTE ZXHN H108N R1A is a wireless router product from China's ZTE Corporation. The webproc cgi module in ZTE ZXHN H108N R1A ZTE.bhs.ZXHNH108NR1A.hPE fails to properly restrict Restricted Directory pathnames, which allows remote attackers to exploit the vulnerability to read arbitrary files on...