CVE-2017-1000391

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional...

CVE-2017-1000391

Jenkins CVE-2017-1000391 affects Jenkins versions 2.88 and earlier and 2.73.2 and earlier. The vulnerability arises because metadata for users (including SCM users) is stored in directories named after their user ID, without escaping, which could lead to overwriting of unrelated configuration fil...

MASTER IPCAMERA01 File Upload and Download Vulnerability

MASTER IPCAMERA01 is an IP network camera product. A security vulnerability exists in MASTER IPCAMERA01 version 3.3.4.2103. An attacker can exploit the vulnerability to upload and download configuration files...

Kaseya VSA R9.2 Arbitrary File Read Vulnerability

A security vulnerability was found in Kaseya VSA file download file functionality. Using this vulnerability an authenticated user in a Kaseya VSA environment is able to download arbitrary files from the server including source code of Kaseya, the database backups, configuration files, and even...

Kaseya VSA R9.2 Arbitrary File Read

------------------------------------------------------------------------ Arbitrary file read in Kaseya VSA ------------------------------------------------------------------------ Kin Hung Cheng, Robert Hartshorn, May 2017 ------------------------------------------------------------------------...

Fedora 27 : systemd (2017-6263c938c7)

Use infinite timeouts for passwords during boot when JobTimeoutSec=0 - Some tty utf8-mode fixes - Only send one auxillary fd set over dbus - Various network-manager crash and spurious assert fixes - Do not remount network filesystems ro during shutdown and unmount DM devices better - Fix...

File Read Vulnerability in ZTE Color Ring Business System

ZTE's ringtone system inherits the stable system architecture of the mobile smart network, follows the latest specifications of operators, and provides flexible interfaces and rich new service functions. A file read vulnerability exists in the ZTE Color Ring service system, which can be exploited...

CVE-2017-15532

Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack also known as directory traversal. These types of attacks aim to access files and directories that are stored outside the web root folder. By manipulating variables, it may be possible to access arbitrary...

Arbitrary File Read Vulnerability in Hazardous Chemicals Public Security Management Information System of Guangzhou Zhongbao Digital Information Technology Co.

Ltd. is a high-tech enterprise engaged in information technology research and development, promotion and application, and technical support services in the field of software, hardware, Internet application technology and other information technology in the field of hazardous explosives-related...

Cygnux sysPass Local File Inclusion Vulnerability

Cygnux sysPass is an open source multi-user password manager that features easy installation, a clear interface and multi-user options. A local file inclusion vulnerability exists in the javascript file inclusion feature in Cygnux sysPass 2.1.7 and earlier versions. An attacker can exploit this...

CVE-2017-1000391

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional...

TIBCO JasperReports 6.4.0 Information Disclosure Vulnerability

TIBCO JasperReports contain a vulnerability which fails to prevent remote access to all the contents of the web application, including key configuration files. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2017-8139

HedEx Earlier than V200R006C00 versions have the stored cross-site scripting XSS vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users...

Ubuntu 14.04 LTS / 16.04 LTS : Berkeley DB vulnerability (USN-3489-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3489-1 advisory. It was discovered that Berkeley DB incorrectly handled certain configuration files. An attacker could possibly use this issue to read sensitive...

USN-3489-2: Berkeley DB vulnerability

USN-3489-1 fixed a vulnerability in Berkeley DB. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that Berkeley DB incorrectly handled certain configuration files. An attacker could possibly use this issue to read sensitive informati...

USN-3489-1 db5.3 vulnerability

It was discovered that Berkeley DB incorrectly handled certain configuration files. An attacker could possibly use this issue to read sensitive information...

USN-3489-1: Berkeley DB vulnerability

It was discovered that Berkeley DB incorrectly handled certain configuration files. An attacker could possibly use this issue to read sensitive information...

[ASA-201711-27] roundcubemail: arbitrary filesystem access

Arch Linux Security Advisory ASA-201711-27 ========================================== Severity: High Date : 2017-11-21 CVE-ID : CVE-2017-16651 Package : roundcubemail Type : arbitrary filesystem access Remote : Yes Link : https://security.archlinux.org/AVG-506 Summary ======= The package...

CVE-2017-1000192

Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information...

CVE-2017-1000192

Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information...