CVE-2020-7008

VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, which may allow an attacker to read arbitrary files from local resources...

CVE-2020-11452

Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources aka SSRF or leak files from the local system using the...

Jinfornet Jreport Path Traversal Vulnerability

JReport seamlessly embeds scalable, interactive analytics into any application. Quickly empower users with reports and dashboards or enable them to build their own. Jreport Help function has a path traversal vulnerability in SendFileServlet. Allows an unauthenticated remote user to view any file ...

SUSE-SU-2020:14334-1 Security update for tomcat6

This update for tomcat6 fixes the following issues: - CVE-2020-1938: Fixed a file contents disclosure vulnerability bsc1164692...

Cerberus Helpdesk Workers File User Credentials Disclosure

Cerberus Helpdesk on Version 4.2.3 Stable Build 925 and 5.4.4 and potentially below, contain an unsecured file which contains configuration details including all user’s usernames and password hashes. Recent assessments: h00die at March 25, 2020 12:30am UTC reported: Found this software in an...

CVE-2020-7480: Improper Control of Generation of Code

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists in Andover Continuum All versions, which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data...

SUSE-SU-2020:0725-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2020-1938: Fixed a file contents disclosure vulnerability bsc1164692...

OPENSUSE-SU-2020:0345-1 Security update for tomcat

This update for tomcat to version 9.0.31 fixes the following issues: Security issues fixed: - CVE-2019-17569: Fixed a regression in the handling of Transfer-Encoding headers that would have allowed HTTP Request Smuggling bsc1164825. - CVE-2020-1935: Fixed an HTTP Request Smuggling issue bsc116486...

CVE-2019-17636

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given...

SUSE-SU-2020:0632-1 Security update for tomcat

This update for tomcat to version 9.0.31 fixes the following issues: Security issues fixed: - CVE-2019-10072: Fixed a denial-of-service that could have been caused by clients omitting WINDOWUPDATE messages in HTTP/2 streams bsc1139924. - CVE-2019-12418: Fixed a local privilege escalation by...

PT-2020-2063

Name of the Vulnerable Software and Affected Versions Andover Continuum All versions Description A code injection vulnerability exists due to improper control of generation of code, which could cause files on the application server filesystem to be viewable when an attacker interferes with an...

PT-2020-9929

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 0.3.9 through 0.15.0 Description The issue concerns the "Mini-Browser" extension, published as "@theia/mini-browser" on npmjs.com, which is one of the default pre-packaged Theia extensions. This extension exposes an HTTP...

Local file disclosure in PHPMailer

An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base...

GHSA-4X5H-CR29-FHP6 Local file disclosure in PHPMailer

An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base...

Kibana 7.3.x < 7.4.0 Local File Disclosure

According to its self-reported version number, the Kibana application running on the remote host is 7.3.x prior to 7.4.0. It is, therefore, affected by a local file disclosure vulnerability in Elastic Code. Note that the scanner has not tested for these issues but has instead relied only on the...

Oracle Weblogic Server Remote Code Execution (CVE-2019-2888)

An External Entity Injection vulnerability exists in Oracle Weblogic. This vulnerability is due to insufficient validation of XML data. A remote attacker could exploit this vulnerability by sending malicious XML data to the target server. Successful exploitation of this vulnerability could result...

CVE

CVE CVE-2017-16900: Hunesion i-oneNet Incorrect Access Con...

CVE-2020-1938: Undefined Security Weakness

When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that...

Wordpress plugin tutor local file leak vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A local file disclosure vulnerability exists in Wordpress plugin tutor. An attacker can exploit the vulnerability to obtain...

Wordpress plugin events-manager local file disclosure vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. events-manager is an events management plugin used in it. A local file disclosure vulnerability exists in the wordpress plugin...