PT-2020-21136

Name of the Vulnerable Software and Affected Versions featurebook affected versions not specified Description The issue allows a malicious actor to access files outside of the intended directory root, potentially disclosing private files on the vulnerable system. This is due to the resolution of...

PT-2020-21389

Name of the Vulnerable Software and Affected Versions @vivaxy/here affected versions not specified Description The issue allows for a directory traversal attack, potentially disclosing files on the local file system that exist outside of the web root, including confidential files. If the node...

PT-2020-21292

Name of the Vulnerable Software and Affected Versions yjmyjmyjm affected versions not specified Description The issue allows a malicious actor to access files outside of the intended directory root, potentially resulting in the disclosure of private files on the vulnerable system. This is achieve...

Oracle E-Business File Disclosure

File disclosure vulnerability in Oracle E-Business bscpgraph.jsp Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Safari Bug Revealed After Apple Takes Nearly a Year to Patch

A security researcher disclosed details of an Apple Safari web browser security hole that could leak files with other browsers and applications and open the door to exploitation by attackers. The disclosure came only after Apple said it would delay patching the vulnerability for nearly a year. Fo...

CVE-2020-17385 Cellopoint CelloOS - Unauthenticated Arbitrary File Disclosure

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access arbitrate file on the system...

QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Disclosure

Exploit Title: QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Disclosure Date: 2020-08-12 Exploit Author: LiquidWorm Vendor Homepage: http://www.howfor.com Tested on: Microsoft Windows Server 2012 R2 Datacenter CVE : N/A QiHang Media Web QH.aspx Digital Signage 3.0.9...

QiHang Media Web Digital Signage 3.0.9 Arbitrary File Disclosure Vulnerability

Exploit for hardware platform in category web applications QiHang Media Web QH.aspx Digital Signage 3.0.9 Arbitrary File Disclosure Vulnerability Vendor: Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Co., Ltd. Product web page: http://www.howfor.com Affected...

QiHang Media Web Digital Signage 3.0.9 Arbitrary File Disclosure

QiHang Media Web QH.aspx Digital Signage 3.0.9 Arbitrary File Disclosure Vulnerability Vendor: Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Co., Ltd. Product web page: http://www.howfor.com Affected version: 3.0.9.0 Summary: Digital Signage Software. Desc: The...

QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Arbitrary File Disclosure Vulnerability

Summary Digital Signage Software. Description The application suffers from an unauthenticated file disclosure vulnerability when input passed thru the 'filename' parameter when using the download action or thru 'path' parameter when using the getAll action is not properly verified before being...

CVE-2020-15820

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

Design/Logic Flaw

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence...

CVE-2020-15820

The CVE-2020-15820 issue affects YouTrack (JetBrains) prior to version 2020.2.6881, where the Markdown parser could disclose the existence of a hidden file. The problem is documented in JetBrains’ Q2 2020 security bulletin, which notes that YouTrack was updated to resolve this vulnerability in 20...

CVE-2020-16136: Improper Limitation of a Pathname to a Restricted Directory

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...

GHSA-9VFJ-5G7H-4P24 Server side template injection in Apache Camel

Server-Side Template Injection and arbitrary file disclosure on Camel templating components...

Server side template injection in Apache Camel

Server-Side Template Injection and arbitrary file disclosure on Camel templating components...

CVE-2020-14490

OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files...

CVE-2020-14490

OpenClinic GA versions 5.09.02 and 5.89.05b contain a path traversal vulnerability (CWE-22) that allows arbitrary local files to be specified via parameters and may execute uploaded files, risking disclosure of sensitive data and code execution. The issue corresponds to CVE-2020-14490; root cause...

FLIR AX8 Thermal Camera Arbitrary File Disclosure

An information disclosure vulnerability exists in FLIR. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...

PT-2020-14183 · Typo3 · Typo3/Cms

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.19 TYPO3 CMS versions 10.0.0 through 10.4.5 Description: In a case where an attacker manages to generate a valid cryptographic message authentication code HMAC-SHA1 - either by using a different existing...