PT-2015-02: Arbitrary File Reading in Arbor Peakflow SP

The specialists of the Positive Research center have detected an Arbitrary File Reading vulnerability in Arbor Peakflow SP. The vulnerability allows remote attackers to read arbitrary files. How to fix Update your system up to the latest version Advisory status 13.01.2015 - Vendor gets...

CVE-2014-9301

Server-side request forgery SSRF vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter. Recent assessments:...

CVE-2014-3537

The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/...

mnoGoSearch 3.3.12 (search.cgi) - Arbitrary File Read

No description provided by source. ----------------------------------------------------------- PT-2013-17 Positive Technologies Security Advisory Arbitrary Files Reading in mnoGoSearch ----------------------------------------------------------- --- Vulnerable software mnoGoSearch Version: 3.3.12...

StatusNet/Laconica 0.7.4, 0.8.2, 0.9.0beta3 - Arbitrary File Reading

No description provided by source. +-------------------------------------------------------------------------------+ + StatusNet/Laconica = 0.7.4, = 0.8.2, = 0.9.0beta3 - arbitrary file reading + +-------------------------------------------------------------------------------+ Date: - 10/10/2013...

CVE-2011-4367

This CVE concerns Apache MyFaces Core (JSF) path traversal in MyFaces JSF. Affected versions are Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6. An attacker can read arbitrary files by supplying a .. sequence via the ln parameter to faces/javax.faces.resource/web.xml or via PATH_INFO to faces/ja...

CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

MGASA-2014-0004 Updated librsvg and gtk+3.0 packages fix security vulnerability

librsvg before version 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference CVE-2013-1881. gtk+3.0 has been patched to cope with the changes in SVG loading due to the fix in librsvg...

CVE-2013-6000

Directory traversal vulnerability in Tattyan HP TOWN before 5101 allows remote attackers to read arbitrary files via a .. dot dot in a request...

StatusNetLaconica 0.7.40.8.20.9.0beta3 - Arbitrary File Reading

StatusNetLaconica 0.7.40.8.20.9.0beta3 - Arbitrary File Reading +-------------------------------------------------------------------------------+ + StatusNet/Laconica title = $this-trimmed'title'; $this-filename = INSTALLDIR.'/doc-src/'.$this-title; //1 if !fileexists$this-filename...

StatusNet/Laconica 0.7.4/0.8.2/0.9.0beta3 - Arbitrary File Reading

+-------------------------------------------------------------------------------+ + StatusNet/Laconica title = $this-trimmed'title'; $this-filename = INSTALLDIR.'/doc-src/'.$this-title; //1 if !fileexists$this-filename $this-clientError'No such document.'; return; $this-showPage;...

CVE-2012-2926

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and...

CVE-2011-4643

Multiple directory traversal vulnerabilities in Splunk 4.x before 4.2.5 allow remote authenticated users to read arbitrary files via a .. dot dot in a URI to 1 Splunk Web or 2 the Splunkd HTTP Server, aka SPL-45243...

PhpMyadmin arbitrary file reading vulnerability-vulnerability warning-the black bar safety net

PhpMyadmin to achieve the wrong using the simplexmlloadstring function for parsing xml, but this function is in default and did not deal with external entities of safety, causing the user can by means of xml files to read and access the application has permission to access system and network...

PT-2011-29: Arbitrary file reading and arbitrary code execution in Router Manager for D-Link DIR-300

Positive Research Center has discovered a vulnerability that allows one to obtain content of arbitrary files and execute arbitrary code. How to fix Update your software up to the latest version Update link Advisory status 09.09.2011 - Vendor is notified 09.09.2011 - Vendor gets vulnerability...

Joomla Appointment Booking Pro Arbitrary File Reading

Appointment Booking Pro is a native Joomla component ================================= Last login: Tue Jun 7 2010 10:20:22 on ttys000 / / / / / / / / / / / / / : / / / / / / / / / / / / / / / | / / / / / / / / / / / / / // / // / / / / --X-- / / / / / / / / / / / / / / / / / / / /...

Mojolicious Directory Traversal Vulnerability

The host is running Mojolicious and is prone to directory traversal vulnerability. OpenVAS Vulnerability Test $Id: gbmojoliciousdirtravvuln.nasl 7577 2017-10-26 10:41:56Z cfischer $ Mojolicious Directory Traversal Vulnerability Authors: Sooraj KS Copyright: Copyright c 2011 Greenbone Networks Gmb...

CVE-2011-0396

Cisco Adaptive Security Appliances ASA 5500 series devices with software 8.0 before 8.05.23, 8.1 before 8.12.49, 8.2 before 8.24.1, and 8.3 before 8.32.13, when a Certificate Authority CA is configured, allow remote attackers to read arbitrary files via unspecified vectors, aka Bug ID CSCtk12352...

CVE-2010-2445

freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality, related to the 1 os, 2 io, 3 package, 4 dofile, 5 loadfile, 6 loadlib, 7 module, and 8 require modules or functions...

CVE-2009-3123

CVE-2009-3123 is a directory traversal vulnerability in Wap-Motor (before version 18.1) affecting the file gallery/gallery.php . The issue occurs when an attacker supplies a malicious value for the image parameter containing “..”, enabling an attacker to read arbitrary files and potentially discl...