Arbitrary file deletion

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials a...

CVE-2021-24227 Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials a...

CVE-2021-24227

Patreon WordPress plugin

PT-2021-15771

Name of the Vulnerable Software and Affected Versions: Patreon WordPress plugin versions prior to 1.7.0 Description: A Local File Disclosure issue was identified in the Patreon WordPress plugin that could be exploited by anyone visiting the site, potentially leading to the leakage of important...

WordPress 信息泄露漏洞

Patreon is a subscription-based crowdfunding platform and Patreon WordPress is a WordPress plugin for the platform. A local file disclosure vulnerability exists in Patreon WordPress versions prior to 1.7.0. An attacker can exploit the vulnerability to obtain internal files such as database...

CVE-2021-24227: Exposure of Sensitive Information to an Unauthorized Actor

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials a...

Security Bulletin: Infosphere BigInsights is affected by multiple IBM DB2 advisories (CVE-2014-8910, CVE-2015-1883, CVE-2015-1922, CVE-2015-1935).

Summary Security Bulletin: Infosphere BigInsights is affected by multiple IBM DB2 advisories CVE-2014-8910, CVE-2015-1883, CVE-2015-1922, CVE-2015-1935. The vulnerabilities exist in the Big SQL server component included in BigInsights. Vulnerability Details CVEID: CVE-2014-8910 DESCRIPTION: IBM D...

Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

The Jetpack Scan team identified a Local File Disclosure vulnerability in the plugin that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in t...

WordPress Patreon WordPress plugin <= 1.6.9 - Local File Disclosure vulnerability

Local File Disclosure vulnerability discovered by Jetpack Scan team in WordPress Patreon WordPress plugin versions = 1.6.9. Solution Update the WordPress Patreon WordPress plugin to the latest available version at least 1.7.0...

CVE-2021-21355

TYPO3 8.7.40, 9.5.25, 10.4.14, 11.1.1 fix a file-upload vulnerability where UploadedFileReferenceConverter can accept any mime-type for certain Extbase-based uploads, allowing attackers to place arbitrary files under /fileadmin/user_upload/ (and potentially reference/guess filenames). Impact stat...

CVE-2019-3897: Files or Directories Accessible to External Parties

It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue...

CVE-2020-28387

CVE-2020-28387 affects Siemens Solid Edge SE2020 before SE2020MP13 and SE2021 before SE2021MP3. The issue arises when opening specially crafted SEECTCXML files; the XML parser can process external entities (XXE) due to insufficient restrictions, enabling disclosure of arbitrary files to an attack...

CVE-2020-28387: Improper Restriction of XML External Entity Reference

A vulnerability has been identified in Solid Edge SE2020 All Versions SE2020MP13, Solid Edge SE2021 All Versions SE2021MP3. When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted...

PT-2021-11512

Name of the Vulnerable Software and Affected Versions: Siemens Solid Edge SE2020 versions prior to SE2020MP13 Siemens Solid Edge SE2021 versions prior to SE2021MP3 Description: A vulnerability allows disclosure of arbitrary files to remote attackers when opening a specially crafted SEECTCXML file...

XML External Entity (XXE) Injection

Overview xmldom is an A pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Affected versions of this package are vulnerable to XML External Entity XXE Injection. Does not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and...

CVE-2021-3310

Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure by reading local files...

CVE-2020-12668

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...

CVE-2020-12668

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...

Arbitrary file deletion

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...

CVE-2020-12668

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure...