The vulnerability of the Action View component of the Ruby on Rails software platform, allowing attackers to read arbitrary files

The vulnerability of the Action View component in the Ruby on Rails software framework is related to errors in handling HTTP headers “Accept” when used in the “render file” handler code. Exploiting this vulnerability allows an attacker to read arbitrary files...

GLSA-201811-08 : Okular: Directory traversal

The remote host is affected by the vulnerability described in GLSA-201811-08 Okular: Directory traversal It was discovered that Okular contains a Directory Traversal vulnerability in function unpackDocumentArchive in core/document.cpp. Impact : A remote attacker could entice a user to open a...

CVE-2019-11378

An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...

Improper access control

An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version for the X7500D TV and other applicable TVs. This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is...

CVE-2019-10886

An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version for the X7500D TV and other applicable TVs. This vulnerability allows an attacker to read arbitrary files without authentication over HTTP when Photo Sharing Plus application is...

Security Bulletin: A security vulnerability has been addressed in IBM Cognos Analytics (CVE-2019-4178)

Summary This bulletin addresses a security vulnerability that has been fixed in IBM Cognos Analytics 11.0.13 FP1 as well as 11.0.9-11.0.12 Interim Fixes. IBM Cognos Analytics could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL reques...

CVE-2018-17289

An XML external entity XXE vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration .ZIP file within the Kofax/KFS/Admin/PackageService/package/uploa...

CVE-2018-17289

An XML external entity XXE vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to read arbitrary files via crafted XML inside an imported package configuration .ZIP file within the Kofax/KFS/Admin/PackageService/package/uploa...

Design/Logic Flaw

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially carry out SSRF attacks. IBM X-Force ID: 159124...

CVE-2019-4203

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially carry out SSRF attacks. IBM X-Force ID: 159124...

Cross site request forgery (csrf)

IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to write or view arbitrary files on the system. IBM X-Force ID: 158919...

CVE-2019-4203

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially carry out SSRF attacks. IBM X-Force ID: 159124...

Advantech WebAccess Access Control Error Vulnerability

Advantech WebAccess is a set of HMI/SCADA software based on browser architecture from Advantech, Taiwan, China. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An Access Control Error vulnerability exist...

Directory traversal

Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the...

CVE-2018-15631

Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request...

CVE-2018-15631

Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request...

Improper access control

Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request...

Code injection

Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC...

Security Bulletin: Vulnerability in Xorg affects AIX (CVE-2018-14665)

Summary There is a vulnerability in Xorg that affects AIX. Vulnerability Details CVEID: CVE-2018-14665 DESCRIPTION: X.Org X server could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper validation of command line parameters. An attacker could...

CVE-2018-15631

Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail themselves arbitrary files from the database, via a crafted RPC request...