CVE-2014-7951

Directory traversal vulnerability in the Android debug bridge aka adb in Android 4.0.4 allows physically proximate attackers with a direct connection to the target Android device to write to arbitrary files owned by system via a .. dot dot in the tar archive headers...

Directory traversal

Directory traversal vulnerability in the Android debug bridge aka adb in Android 4.0.4 allows physically proximate attackers with a direct connection to the target Android device to write to arbitrary files owned by system via a .. dot dot in the tar archive headers...

CVE-2014-7951

Directory traversal vulnerability in the Android debug bridge aka adb in Android 4.0.4 allows physically proximate attackers with a direct connection to the target Android device to write to arbitrary files owned by system via a .. dot dot in the tar archive headers...

Joplin Cross-Site Scripting Vulnerability (CNVD-2020-10126)

Joplin is an open source notes and to-do list application with synchronization capabilities. A cross-site scripting vulnerability exists in Joplin 1.0.184 and earlier versions. An attacker can exploit this vulnerability to read arbitrary files...

CVE-2015-4715

The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ at sign character in unspecified POS...

Authentication flaw

Kaseya Virtual System Administrator VSA 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and 1 add an administrative account via crafted request to...

CVE-2015-6922

Kaseya Virtual System Administrator VSA 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and 1 add an administrative account via crafted request to...

Directory traversal

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. dot dot in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete...

CVE-2015-6589

Directory traversal vulnerability in Kaseya Virtual System Administrator VSA 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file...

CVE-2020-8803

SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via addtoprospectlist...

CVE-2013-4535

The virtqueuemapsg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read...

CVE-2014-2052

Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

CVE-2013-4535

The virtqueuemapsg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read...

CVE-2013-4535

QEMU's virtqueue_map_sg in hw/virtio/virtio.c (affected: before 1.7.2) allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read. Root cause is in virtqueue handling; impact is arbitrary code execution with local access. Remediati...

Symantec Endpoint Protection AvHostPlugin Missing Authentication Arbitrary File Move Vulnerability

This vulnerability allows local attackers to move arbitrary files on affected installations of Symantec Endpoint Protection. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Bosch DIVAR IP 3000 Path Traversal Vulnerability

Bosch DIVAR IP 3000 is a 3000 series video recorder from Bosch Germany. A path traversal vulnerability exists in Bosch DIVAR IP 3000. An unauthenticated, remote attacker could read arbitrary files from a centralized server...

Information disclosure

The FailOverHelperServlet aka FailServlet servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to 1 read arbitrary...

CVE-2019-11481 Apport reads arbitrary files if ~/.config/apport/settings is a symlink

Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences...

CVE-2020-6768

A path traversal vulnerability in the Bosch Video Management System BVMS NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 = 10.0.0.1225, 9.0 = 9.0.0.827, 8.0 = 8.0.329 and 7.5 and older. This affect...

Path traversal

A path traversal vulnerability in the Bosch Video Management System BVMS NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 = 10.0.0.1225, 9.0 = 9.0.0.827, 8.0 = 8.0.329 and 7.5 and older. This affect...