Explzh Path Traversal Vulnerability

Explzh is a zip file extraction tool. A path traversal vulnerability exists in Explzh 7.58 and earlier versions, which can be exploited by an attacker to read arbitrary files...

Security Bulletin: Arbitrary File Reads (CVE-2018-1705) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Arbitrary File Reads CVE-2018-1705 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1705 DESCRIPTION: IBM Platform Symphony contains an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive...

Debian DLA-1426-1 : cups security update

Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids : CVE-2018-4180 Dan Bastone of Gotham Digital Science discovered that a local attacker with access to cupsctl could escalate privileges by setting an...

Open-Xchange (OX) App Suite Path Traversal Vulnerability (Jun 2018)

Open-Xchange OX App Suite is prone to a path traversal vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

XML External Entities (XXE)

translate-toolkit is vulnerable to XML External Entity XXE attacks. The vulnerability exists due to the use of insecure defaults where external entities were resolved. This allows arbitrary file reads when processing malicious XML files...

ALPINE-CVE-2017-9993

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensions and demuxer names, which allows attackers to read arbitrary files via crafted playlist data...

Apache Ignite Information Disclosure and XML External Entity Injection Vulnerabilities

Ignite is the in-memory computing platform. Apache Ignite suffers from an information disclosure and XML external entity injection vulnerability, which can be exploited by an attacker to modify the update-notifier document and read arbitrary files via an XXE attack...

Arbitrary File Read And Denial Of Service (DoS)

fury-adapter-swagger is vulnerable to arbitrary file reads off the file system and denial of service DoS attacks. This could be used to retrieve sensitive data, or fill the entire available memory and cause a denial of service by reading/dev/zero...

Brocade Network Advisor Directory Traversal Vulnerability

Brocade Network Advisor is a set of management tools for the entire network lifecycle from Brocade Communications Systems Brocade. A directory traversal vulnerability exists in the CliMonitorReportServlet in Brocade Network Advisor 14.0.2 and earlier versions. A remote attacker could exploit this...

The vulnerability of the ColdFusion interpreter allows attackers to read arbitrary files or send TCP requests to servers in the internal network.

The vulnerability of the Office Open XML OOXML file format in ColdFusion is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows an attacker to remotely read arbitrary files or send TCP requests to internal server networks using a specially...

Trello: File access using image tragick

While Trello had patched our image libraries to prevent the RCE vulnerability in ImageMagick, we had not applied a patch to prevent arbitrary file reads via labels in mvg files. After resolving the issue, we were able to determine that no files had actually been accessed using this vulnerability,...

Codoforum Filtering Feature Directory Traversal Vulnerability

Codoforum is a forum application. The Codoforum filter function fails to properly handle user-submitted PATH parameters, allowing attackers to perform directory traversal attacks and read the contents of arbitrary system files...

CVE-2013-4152

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...

DEBIAN-CVE-2013-0340

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XMLSetEntityDeclHandler function, which allows remote attackers to cause a denial of service resource consumption, send HTTP requests to intranet servers, or read arbitrary files via a...

WordPress 'WP CSS' Plugin Local File Inclusion Vulnerability

WordPress WP CSS Plugin is prone to local file inclusion vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mandrake Security Advisory MDVSA-2009:065 (php4)

The remote host is missing an update to php4 announced via advisory MDVSA-2009:065. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...