418 matches found
CVE-2019-9530
The CVE-2019-9530 entry applies to Cobham EXPLORER 710 (firmware 1.07). The vulnerability is that the web root directory has no access restrictions, enabling an unauthenticated, local attacker connected to the device to read and download any file in the web root. The provided connected documents ...
Ubuntu 16.04 LTS / 18.04 LTS : Firefox regressions (USN-4054-2)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4054-2 advisory. USN-4054-1 fixed vulnerabilities in Firefox. The update introduced various minor regressions. This update fixes the problems. We apologize for the...
Mozilla Thunderbird < 60.8
The version of Thunderbird installed on the remote Windows host is prior to 60.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-23 advisory. - A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use,...
PT-2019-2927 · Mysql Server +4 · Mysql Connector/J +4
Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x before 2.9.9 Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint and the service has the...
Cisco HyperFlex software file access vulnerability
Cisco HyperFlex Software is the United States Cisco Cisco company's set of scalable distributed file system. The system provides unified computing, storage and networking through cloud management, and provides enterprise-class data management and optimization services. A file access vulnerability...
MGASA-2019-0080 Updated gvfs packages fix security vulnerability
The backend currently allows to access and modify files without prompting for password if any polkit authentication agent isn't available. This affects only users which belong to wheel group i.e. those who are already allowed to use sudo. It doesn't allow privilege escalation for users, who don't...
CVE-2018-19046
The CVE-2018-19046 entry concerns keepalived 2.0.8 failing to validate existing plain files when writing to a temporary file during PrintData/PrintStats. If an attacker locally created /tmp/keepalived.data or /tmp/keepalived.stats with read permissions for the attacker and write permissions for k...
PT-2018-13871 · Telerik · Telerik Extensions For Asp.Net Mvc
Name of the Vulnerable Software and Affected Versions: Telerik Extensions for ASP.NET MVC all versions Description: The issue allows a remote attacker to access files inside the server's web directory because it does not properly restrict access to these files. This product has been obsolete sinc...
CVE-2018-12564
CVE-2018-12564 affects LAVA (lava-server) where support for URLs in the submit page can be abused to force lava-server-gunicorn to read arbitrary server files readable by lavaserver and containing valid YAML. Impact per the sources is information disclosure (no explicit compromise of integrity/av...
CVE-2018-1000181
CVE-2018-1000181 affects Kitura 2.3.0 and earlier, where an unintended read access to unauthorized files and folders can be triggered by a specially crafted URL, resulting in information disclosure. The connected documents consistently describe this as a information-disclosure vulnerability in Ki...
Directory Traversal
micra is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of ../ sanitization on the user input, allowing attackers to access files outside of the server's scope...
CVE-2017-18192
CVE-2017-18192 describes a vulnerability in the Android version of the app named “Photo,Video Locker-Calculator.” The issue, located in CalculatorActivity.java, allows an attacker to access files via a backdoor PIN (17621762). According to the connected documents, this affects the app through ver...
CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid...
TRITON AP-EMAIL File Access Vulnerability
Websense TRITON AP-EMAIL is a suite of email security solutions from Websense USA. The solution identifies targeted attacks, high-risk users and insider threats, while enabling mobile workers to take countermeasures and ensure their secure use of technologies such as Microsoft Office 365. The...
Directory Traversal
Overview Affected versions of reecerver resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...
Directory Traversal
Overview Affected versions of dcserver resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...
Directory Traversal
Overview Affected versions of cuciuci resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...
Design/Logic Flaw
Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and configuration files...
rConfig 3.1.1 - Local File Inclusion
Title =================== rConfig, the open source network device configuration management tool, Vulnerable to Local File Inclusion Summary =================== rConfig, the open source network device configuration management tool, is vulnerable to local file inclusion in /lib/crud/downloadFile.ph...