PT-2019-4677

Name of the Vulnerable Software and Affected Versions Apache POI versions up to 4.1.0 Description The issue is related to the XSSFExportToXml tool in Apache POI, which can be exploited to read files from the local filesystem or internal network resources via XML External Entity XXE Processing whe...

Cisco SPA100 Series Multiple Vulnerabilities

The remote Cisco SPA100 Series device is affected by multiple vulnerabilities: - Multiple remote code execution vulnerabilities. An authenticated attacker can cause a stack overflow leading to control flow change in the Cisco SPA 112/122 device. CVE-2019-15240, CVE-2019-15241, CVE-2019-15242,...

CVE-2019-12704

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters ATAs could allow an authenticated, remote attacker to view the contents of arbitrary files on an affected device. The vulnerability is due to improper input validation in the web-based managemen...

CVE-2019-12704 Cisco SPA100 Series Analog Telephone Adapters Web-Based Management Interface File Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters ATAs could allow an authenticated, remote attacker to view the contents of arbitrary files on an affected device. The vulnerability is due to improper input validation in the web-based managemen...

CVE-2019-12704 Cisco SPA100 Series Analog Telephone Adapters Web-Based Management Interface File Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters ATAs could allow an authenticated, remote attacker to view the contents of arbitrary files on an affected device. The vulnerability is due to improper input validation in the web-based managemen...

CVE-2019-12704

The CVE-2019-12704 issue affects Cisco SPA100 Series Analog Telephone Adapters and concerns the web-based management interface. Root cause: improper input validation in the management UI, which allows an authenticated (and per some sources unauthenticated) attacker to send crafted requests that d...

Cisco SPA100 Series Analog Telephone Adapters Web-Based Management Interface File Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters ATAs could allow an authenticated, remote attacker to view the contents of arbitrary files on an affected device. The vulnerability is due to improper input validation in the web-based managemen...

PT-2019-3623

Name of the Vulnerable Software and Affected Versions Cisco SPA100 Series Analog Telephone Adapters ATAs affected versions not specified Description The issue is related to improper input validation in the web-based management interface, allowing an authenticated, remote attacker to view the...

Authentication flaw

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via logget.php, which could be used to discover the intranet network structure...

GHSA-67CX-RHHQ-MFHQ High severity vulnerability that affects indico

Local file disclosure through LaTeX injection Impact An external audit of the Indico codebase has discovered a vulnerability in Indico's LaTeX sanitization code, which could have malicious users to run unsafe LaTeX commands on the server. Such commands allowed for example to read local files e.g...

PT-2019-20011

Name of the Vulnerable Software and Affected Versions Indico versions prior to 2.2.3 Indico versions prior to 2.1.10 Description A vulnerability in Indico's LaTeX sanitization code allows malicious users to run unsafe LaTeX commands on the server, potentially leading to local file disclosure. For...

CVE-2019-12711

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service DoS condition. The vulnerability ...

CVE-2019-7618

A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user...

CVE-2019-7618

A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user...

Code injection

A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user...

CVE-2019-7618

CVE-2019-7618 – Elastic Code local file disclosure : Affects Elastic Code versions 7.3.0–7.3.2. If a malicious code repository is imported into Code, an attacker can read arbitrary files from the Kibana instance’s local filesystem with the Kibana system user’s permissions. Root cause: improper ha...

CVE-2019-7618

A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user...

Elastic Stack 7.4.0 security update

Elastic Code local file disclosure flaw ESA-2019-12 A local file disclosure flaw was found in Elastic Code. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana...

PT-2019-18670

Name of the Vulnerable Software and Affected Versions Elastic Code versions 7.3.0 through 7.3.2 Description A local file disclosure flaw was found in Elastic Code. If a malicious code repository is imported into Code, it is possible to read arbitrary files from the local filesystem of the Kibana...

CVE-2019-7618: Insertion of Sensitive Information into Externally-Accessible File or Directory

A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user...