CVE-2019-12154: Improper Restriction of XML External Entity Reference

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions...

CVE-2019-12274: Exposure of Resource to Wrong Sphere

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

CVE-2019-9157

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

CVE-2019-9157

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

Arbitrary file deletion

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

CVE-2019-9157

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

CVE-2019-9157

Gemalto DS3 Authentication Server (also known as Ezio Server) contains a Local File Disclosure vulnerability tracked as CVE-2019-9157. The advisory data in the PacketStorm SEC Consult entry indicates vulnerable releases are Ezio DS3 server earlier than v3.1.0, with the fix released in v3.1.0. The...

CVE-2019-9157: Improper Limitation of a Pathname to a Restricted Directory

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

PT-2019-19401

Name of the Vulnerable Software and Affected Versions Gemalto DS3 Authentication Server version 2.6.1-SP01 Description The issue allows for Local File Disclosure. Recommendations For Gemalto DS3 Authentication Server version 2.6.1-SP01, update to a version that fixes this issue, if available. At...

ai.hyacinth.framework:core-service-admin-server (0.5.0), ai.hyacinth.framework:core-service-config-server (0.5.0) +1514 more potentially affected by CVE-2019-0221 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.16)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =greenwich.sr1, =greenwich.sr1, =greenwich.sr1, =1.0.0, =1.5.2 - ch.puzzle:libpuzzle-demo-spring-boot-rest 0.1.0-rc1 - ch.puzzle:libpuzzle-spring-boot-rest-testing 0.1.0-rc1 - club.mydlq:swagger-kubernetes 2.1.0 -...

PT-2019-20014

Name of the Vulnerable Software and Affected Versions ltt.js versions affected versions not specified Description The issue allows a malicious actor to access files outside of the intended directory root, potentially disclosing private files on the vulnerable system. This is achieved through a...

UBUNTU-CVE-2019-9892

An issue was discovered in Open Ticket Request System OTRS 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of...

Apache Roller File Disclosure

File disclosure vulnerability via XXE in Apache Roller Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

CVE-2019-5936

Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application 'Work Flow'...

PT-2019-17883

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.0.0 through 4.10.1 Description The issue allows remote authenticated attackers to bypass access restrictions and obtain files without proper access privileges. This is achieved through the Multiple Files Download...

CVE-2019-1820

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to...

CVE-2019-1818: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to...

CVE-2019-1820: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to...

CVE-2019-7404

CVE-2019-7404 affects LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file by issuing an HTTP request that includes the file’s full pathname (for example, http://192.168.0.1/var/gapm7100_${today’s_date}.log). The connected Red Hat and CVE records reiterate t...

Gemalto DS3 Authentication Server / Ezio Server Command Injection / File Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Gemalto Thales Group DS3 Authentication Server / Ezio Server vulnerable version: Ezio DS3 server v3.1.0 fixed version: Ezio DS3 server...