CVE-2019-12154

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions...

CVE-2019-12154

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions...

CVE-2019-9157

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

CVE-2019-9157

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

Arbitrary file deletion

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

CVE-2019-9157

Gemalto DS3 Authentication Server (also known as Ezio Server) contains a Local File Disclosure vulnerability tracked as CVE-2019-9157. The advisory data in the PacketStorm SEC Consult entry indicates vulnerable releases are Ezio DS3 server earlier than v3.1.0, with the fix released in v3.1.0. The...

CVE-2019-9157

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

UBUNTU-CVE-2019-9892

An issue was discovered in Open Ticket Request System OTRS 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of...

Apache Roller File Disclosure

File disclosure vulnerability via XXE in Apache Roller Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

CVE-2019-5936

Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application 'Work Flow'...

CVE-2019-1820

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to...

CVE-2019-7404

CVE-2019-7404 affects LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file by issuing an HTTP request that includes the file’s full pathname (for example, http://192.168.0.1/var/gapm7100_${today’s_date}.log). The connected Red Hat and CVE records reiterate t...

Gemalto DS3 Authentication Server / Ezio Server Command Injection / File Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Gemalto Thales Group DS3 Authentication Server / Ezio Server vulnerable version: Ezio DS3 server v3.1.0 fixed version: Ezio DS3 server...

openSUSE Security Update : rubygem-actionpack-5_1 (openSUSE-2019-1344)

This update for rubygem-actionpack-51 fixes the following issues : Security issues fixed : - CVE-2019-5418: Fixed a file content disclosure vulnerability in Action View which could be exploited via specially crafted accept headers in combination with calls to render file bsc1129272. -...

Pornhub: SSRF and local file disclosure by video upload on http://www.youporn.com/

The researcher was successful in exploiting a vulnerability in 3rd encoding party library resulting in the execution of SSRF attacks and Local File Disclosure...

Pornhub: SSRF and local file disclosure by video upload on https://www.tube8.com/

The researcher was successful in exploiting a vulnerability in 3rd party encoding library resulting in the execution of SSRF attacks and Local File Disclosure...

WordPress Diarise 1.5.9 Local File Disclosure

Local File Disclosure in wordpress theme Diarise + Date: 07/05/2019 + CWE Number: CWE-98 + Risk: High + Author: Felipe Andrian Peixoto + Dork: inurl:"wp-content/themes/diarise/" + Vendor Homepage: https://woocommerce.com/?aff=1790 + Contact: [email protected] + Tested on: Windows 7 and...

Pornhub: SSRF and local file disclosure by video upload on https://www.redtube.com/upload

The researcher was successful in exploiting a vulnerability in 3rd party encoding library resulting in the execution of SSRF attacks and Local File Disclosure...

openwsman: Disclosure of arbitrary files outside of the registered URIs

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman serve...

EulerOS 2.0 SP5 : openwsman (EulerOS-SA-2019-1331)

According to the version of the openwsman packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon wa...