Cross-Site Request Forgery (CSRF)

Apache Geronimo application server is vulnerable to cross-site request forgery. Attackers can exploit the vulnerability to obtain sensitive information, upload arbitrary files, execute arbitrary script code, steal cookie-based authentication credentials, or perform certain administrative actions...

XML External Entity (XXE)

liferay portal is vulnerable to XML external entity XXE attacks. A remote authenticated user is able to exploit the vulnerability to read arbitrary files via an entity declaration in conjunction with an entity reference...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Ghostscript vulnerabilities (USN-3915-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3915-1 advisory. It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into...

Input validation

A vulnerability in the web-based management interface of Session Initiation Protocol SIP Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficient input validation and file-level...

CVE-2019-1765

A vulnerability in the web-based management interface of Session Initiation Protocol SIP Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficient input validation and file-level...

Code injection

The SHAREit application before 4.0.42 for Android allows a remote attacker on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated to download arbitrary files from the device including contacts, photos, videos, sound clips, etc. The...

CVE-2019-9938

The SHAREit application before 4.0.42 for Android allows a remote attacker on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated to download arbitrary files from the device including contacts, photos, videos, sound clips, etc. The...

CVE-2019-9938

The SHAREit application before 4.0.42 for Android allows a remote attacker on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated to download arbitrary files from the device including contacts, photos, videos, sound clips, etc. The...

The vulnerability of the Cisco Application Policy Infrastructure Controller, a component of the information infrastructure management tool, stems from insufficient validation of input data. This allows attackers to read arbitrary files.

The vulnerability of the Cisco Application Policy Infrastructure Controller, a component of the information infrastructure management tool, is related to insufficient validation of input data when operating in ACI mode. Exploiting this vulnerability could allow a local attacker to read arbitrary...

CVE-2019-8997

An XML External Entity Injection XXE vulnerability in the Management System console of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XM...

CVE-2019-6273

downloadfile in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files...

CVE-2019-6273

downloadfile in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files...

CVE-2019-5417

A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server...

Path traversal

A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote server...

Code injection

downloadfile in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files...

Cisco Patches High-Severity Flaws in IP Phones

Cisco Systems is urging customers to update several models of their IP phones after issuing patches for five high-severity flaws found in its popular business-focused IP phones. Impacted are Cisco’s IP Phone 8800 series, which are business desk phones that have HD video included and its IP Phone...

WordPress Nishizawa_Tmp Themes Database Profile Download Vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A database configuration file download vulnerability exists in WordPress NishizawaTmp Themes, which can be exploited by an attacker to download arbitrary files...

"an" App for iOS Directory Traversal Vulnerability

"an" App for iOS is an app. A directory traversal vulnerability exists in "an" App for iOS. A remote attacker can exploit this vulnerability to obtain arbitrary files...

CVE-2019-6273

downloadfile in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files...

File Deletion Vulnerability in NetSoft Zhicheng Classifieds Website System

NetSoft Zhicheng classifieds website system is a php mysql based website building system. NetSoft Zhicheng classifieds website system file deletion vulnerability, an attacker can use the vulnerability to delete arbitrary files...