LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 === LSE Leading Security Experts GmbH - Security Advisory LSE-2014-05-21 === CheckMK - Arbitrary File Disclosure Vulnerability - -------------------------------------------------- Affected Versions ================= Linux versions of CheckMK equal or...

WordPress Tera Charts Plugin - Remote Path Traversal File Disclosure

Tera Charts plugin's zoomabletreemap.php "fn" parameter is prone to remote path traversal file disclosure vulnerability that allow an attacker to get potentially sensitive information. Other attacks are also possible. Solution Update the plugin...

ownCloud 'SabreDAV' Local File Disclosure Vulnerability (oC-SA-2013-016) - Windows

ownCloud is prone to a local file disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; i...

ownCloud Multiple Code Execution & Local File Disclosure Vulnerabilities (May 2014)

ownCloud is prone to multiple arbitrary code execution and local file disclosure vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

http-vuln-cve2006-3392 NSE Script

Exploits a file disclosure vulnerability in Webmin CVE-2006-3392 Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML. This allows arbitrary files to be read, without requiring authentication, using "..%01" sequences to bypass the removal of "../"...

CVE-2014-0646: Undefined Security Weakness

The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files...

pfSense Snort File Disclosure

File disclosure vulnerability in snortlogview.php Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

TRENDnet TEW-634GRU 1.00.23 - Multiple Vulnerabilities

TRENDnet TEW-634GRU 1.00.23 - Multiple Vulnerabilities Title: TRENDnet TEW-634GRU 1.00.23 Multiple Vulnerabilities Author: SirGod Website: www.rstforums.com Vendor Homepage: http://www.trendnet.com/ Version: 1.00.23 1. Local file disclosure The router has the TFTP service enabled by default and i...

TRENDnet TEW-634GRU 1.00.23 - Multiple Vulnerabilities

Title: TRENDnet TEW-634GRU 1.00.23 Multiple Vulnerabilities Author: SirGod Website: www.rstforums.com Vendor Homepage: http://www.trendnet.com/ Version: 1.00.23 1. Local file disclosure The router has the TFTP service enabled by default and it can be accessed without any prior authentication sinc...

TRENDnet TEW-634GRU 1.00.23 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Title: TRENDnet TEW-634GRU 1.00.23 Multiple Vulnerabilities Author: SirGod Website: www.rstforums.com Vendor Homepage: http://www.trendnet.com/ Version: 1.00.23 1. Local file disclosure The router has the TFTP service enabled by default a...

TRENDnet TEW-634GRU 1.00.23 Disclosure / DoS / Privilege Escalation

Title: TRENDnet TEW-634GRU 1.00.23 Multiple Vulnerabilities Author: SirGod Website: www.rstforums.com Vendor Homepage: http://www.trendnet.com/ Version: 1.00.23 1. Local file disclosure The router has the TFTP service enabled by default and it can be accessed without any prior authentication sinc...

DEBIAN-CVE-2014-0054

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML Extern...

XML External Entity (XXE) Injection

Overview Scrapy is a high-level web crawling and web scraping framework, used to crawl websites and extract structured data from their pages. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the sitemap reader. Details XXE Injection is a type of attack...

SEC Consult SA-20140402-0 :: Multiple vulnerabilities in Rhythm File Manager

SEC Consult Vulnerability Lab Security Advisory 20140402-0 ======================================================================= title: Multiple vulnerabilities product: Rhythm Software File Manager Rhythm Software File Manager HD vulnerable version: File Manager 1.16.6 File Manager HD 1.11.5...

EMC Cloud Tiering Appliance XML External Entity (XXE) Arbitrary File Disclosure

The remote EMC Cloud Tiering Appliance CTA install is affected by an arbitrary file disclosure vulnerability. It is possible to view any file on the system by utilizing XML external entity injection in specially crafted XML data sent to the REST service on the remote host. Note that hosts that ar...

Apache Camel XSLT Component XML External Entity (CVE-2014-0002)

An XML External Entity XXE vulnerability has been reported in Apache Camel. The vulnerability is due to an error in handling XSL stylesheets in the XSLT component. A remote, unauthenticated attacker can exploit this vulnerability to disclose the contents of files accessible to Apache Camel's Java...

ionCube Loader < 2.46 Multiple Vulnerabilities - Active Check

ionCube Loader is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mozilla Firefox for Android < 28.0.1 Multiple Vulnerabilities

Binary data 8175.prm...

Trixbox Pro Remote Command Execution

App : Trixbox all versions vendor : trixbox.com Author : i-Hmx mail : [email protected] Home : security arrays inc , sec4ever.com ,exploit4arab.net Well well well , we decided to give schmoozecom a break and have a look @ fonality products do you think they have better product than the Award...

Fonality trixbox - mac Remote Code Injection

Fonality trixbox - mac Remote Code Injection App : Trixbox all versions vendor : trixbox.com Author : i-Hmx mail : [email protected] Home : security arrays inc , sec4ever.com ,exploit4arab.net Well well well , we decided to give schmoozecom a break and have a look @ fonality products do you think...