CVE-2020-5916

In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory...

CVE-2020-5916

CVE-2020-5916 affects F5 BIG-IP: certificates admin and higher privileged roles can read arbitrary files outside the web root via the BIG-IP Configuration utility. Affects BIG-IP versions 15.1.0–15.1.0.4 and 15.0.0–15.0.1. The root cause is improper enforcement of file read permissions in the Con...

ZTE ZXR10 1800-2S suffers from a file read vulnerability (CNVD-2019-46634)

The ZXR10 1800-2S is a router product from China's ZTE Corporation ZTE. A file read vulnerability exists in the ZTE ZXR10 1800-2S. An attacker can exploit this vulnerability to read arbitrary files...

Deserialization of untrusted data in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specificall...

The vulnerability of the Intel Graphics Driver lies in its lack of proper input data validation, allowing attackers to gain access to and read arbitrary files.

The vulnerability of the Kernel Mode Driver component in Intel Graphics Drivers exists due to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to gain access to and read arbitrary files...

CVE-2018-14672

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages. Andrey Krasichkov of Yandex Information Security Team...

Explzh Path Traversal Vulnerability

Explzh is a zip file extraction tool. A path traversal vulnerability exists in Explzh 7.58 and earlier versions, which can be exploited by an attacker to read arbitrary files...

Security Bulletin: Arbitrary File Reads (CVE-2018-1705) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Arbitrary File Reads CVE-2018-1705 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1705 DESCRIPTION: IBM Platform Symphony contains an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive...

Debian DLA-1426-1 : cups security update

Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids : CVE-2018-4180 Dan Bastone of Gotham Digital Science discovered that a local attacker with access to cupsctl could escalate privileges by setting an...

Open-Xchange (OX) App Suite Path Traversal Vulnerability (Jun 2018)

Open-Xchange OX App Suite is prone to a path traversal vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

XML External Entities (XXE)

translate-toolkit is vulnerable to XML External Entity XXE attacks. The vulnerability exists due to the use of insecure defaults where external entities were resolved. This allows arbitrary file reads when processing malicious XML files...

ALPINE-CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

Apache Ignite Information Disclosure and XML External Entity Injection Vulnerabilities

Ignite is the in-memory computing platform. Apache Ignite suffers from an information disclosure and XML external entity injection vulnerability, which can be exploited by an attacker to modify the update-notifier document and read arbitrary files via an XXE attack...

Arbitrary File Read And Denial Of Service (DoS)

fury-adapter-swagger is vulnerable to arbitrary file reads off the file system and denial of service DoS attacks. This could be used to retrieve sensitive data, or fill the entire available memory and cause a denial of service by reading/dev/zero...

Brocade Network Advisor Directory Traversal Vulnerability

Brocade Network Advisor is a set of management tools for the entire network lifecycle from Brocade Communications Systems Brocade. A directory traversal vulnerability exists in the CliMonitorReportServlet in Brocade Network Advisor 14.0.2 and earlier versions. A remote attacker could exploit this...

The vulnerability of the ColdFusion interpreter allows attackers to read arbitrary files or send TCP requests to servers in the internal network.

The vulnerability of the Office Open XML OOXML file format in ColdFusion is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows an attacker to remotely read arbitrary files or send TCP requests to internal server networks using a specially...

Trello: File access using image tragick

While Trello had patched our image libraries to prevent the RCE vulnerability in ImageMagick, we had not applied a patch to prevent arbitrary file reads via labels in mvg files. After resolving the issue, we were able to determine that no files had actually been accessed using this vulnerability,...

Codoforum Filtering Feature Directory Traversal Vulnerability

Codoforum is a forum application. The Codoforum filter function fails to properly handle user-submitted PATH parameters, allowing attackers to perform directory traversal attacks and read the contents of arbitrary system files...

CVE-2013-4152

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...

DEBIAN-CVE-2013-0340

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XMLSetEntityDeclHandler function, which allows remote attackers to cause a denial of service resource consumption, send HTTP requests to intranet servers, or read arbitrary files via a...