PT-2017-16654 · Apache +2 · Apache Batik +2

Name of the Vulnerable Software and Affected Versions: Apache Batik versions prior to 1.9 Description: The issue allows arbitrary users to reveal files on the server's filesystem by sending maliciously formed SVG files. The types of files that can be accessed depend on the user context in which t...

Atlassian JIRA XXE / Deserialization Vulnerability

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. SPDX-FileCopyrightText: 2017...

For cross-browser local file disclosure vulnerability analysis-vulnerability warning-the black bar safety net

Foreword You know? You can easily turn ordinary file selector into a folder picker, to do this, simply drag the attribute“webkitdirectory”added to the type ='file'in the given input element on the line. Of course, with the folder selector is different, eventually you will load a given folder all...

CVE-2017-7457

XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure...

CVE-2017-7457

XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure...

Xxe

XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure...

CVE-2017-7457

CVE-2017-7457 affects Moxa MX-AOPC Server 1.5 (MX-AOPC UA Server). The vulnerability is an XML External Entity (XXE) injection via ".AOP" files, leading to remote file disclosure. Root cause is improper handling of external entities in MX-AOPC Server file types. Public references in the connected...

CVE-2017-7457

XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure...

Nextcloud: https://portal.nextcloud.com/.htaccess file is readable

@mksahilisr reported a disclosure of the .htaccess file on https://portal.nextcloud.com. This has been resolved by adding the following to the Apache server configuration: order allow,deny deny from all Since the .htaccess file contained some potential sensitive data this report has only been...

CVE-2017-7457: Improper Restriction of XML External Entity Reference

XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure...

PT-2017-17750

Name of the Vulnerable Software and Affected Versions Moxa MX-AOPC Server version 1.5 Description The issue allows for remote file disclosure via XML External Entity XXE vulnerability through ".AOP" files used by the Moxa MX-AOPC Server. Recommendations For Moxa MX-AOPC Server version 1.5, update...

XML External Entity (XXE) Injection

Apache batik is susceptible to denial of service DoS or file disclosure through XML external entities XXE. The attacks are possible because it does not prevent dereferencing of XML external entities in the DTD and revealing the content of the target file in the output...

Oracle Linux 7 : libreoffice (ELSA-2017-0914)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0914 advisory. - Resolves: rhbz1435534 CVE-2017-3157 Arbitrary file disclosure in Calc and Writer - Resolves: rhbz1353839 CVE-2016-4324 dereference of invalid STL iterator on...

libreoffice: Arbitrary file disclosure in Calc and Writer

It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document...

Moxa MX AOPC-Server XML External Entity Injection Vulnerability

The Moxa MX-AOPC UA Kit is an OPC UA server for industrial automation that supports push-pull communication. An XML external entity injection vulnerability exists in the Moxa MX AOPC-Server. The vulnerability is due to remote file disclosure due to ".AOP" files used through the MX-AOPC Server...

Moxa MX-AOPC UA Server 1.5 XML Injection

Credits: John Page AKA HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MX-AOPC-SERVER-v1.5-XML-EXTERNAL-ENTITY.txt + ISR: ApparitionSec Vendor: ============ www.moxa.com Product: ======================= MX-AOPC UA SERVER - 1.5 Moxa's MX-AOPC...

Moxa MX AOPC-Server v1.5 XML External Entity Exploit

Exploit for windows platform in category remote exploits + Credits: John Page AKA HYP3RLINX Vendor: ============ www.moxa.com Product: ======================= MX-AOPC UA SERVER - 1.5 Moxa's MX-AOPC UA Suite is the first OPC UA server for industrial automation supporting both push and pull...

Moxa MX AOPC-Server 1.5 - XML External Entity Injection

Moxa MX AOPC-Server 1.5 - XML External Entity Injection + Credits: John Page AKA HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MOXA-MX-AOPC-SERVER-v1.5-XML-EXTERNAL-ENTITY.txt + ISR: ApparitionSec Vendor: ============ www.moxa.com Product:...

GeoMoose <= 2.9.2 - Directory Traversal Vulnerability

Exploit for php platform in category web applications Exploit Title: GeoMoose = 2.9.2 Local File Disclosure Exploit Author: Sander 'dsc' Ferdinand Date: 2017-03-4 Version: = 2.9.2 Blog: https://ced.pwned.systems/advisories-geomoose-local-file-disclosure-2-9-2.html Vendor Homepage: geomoose.org...

CVE-2017-0885

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception...