7642 matches found
IBM Rational Focal Point Login Servlet File Disclosure
Nessus was able to exploit a file disclosure vulnerability in the Login servlet on the remote IBM Focal Point install. A remote attacker could potentially use this vulnerability to view sensitive files such as configuration files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
IBM Rational Focal Point RequestAccessController Servlet File Disclosure
Nessus was able to exploit a file disclosure vulnerability in the RequestAccessController serlvet on the remote IBM Focal Point install. A remote attacker could leverage this vulnerability to view sensitive files such as configuration files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
SEC Consult SA-20140228-1 :: Authentication bypass (SSRF) and local file disclosure in Plex Media Server
SEC Consult Vulnerability Lab Security Advisory 20140228-1 ======================================================================= title: Authentication bypass SSRF and local file disclosure product: Plex Media Server vulnerable version: =0.9.9.2.374-aa23a69 fixed version: =0.9.9.3 impact: Critic...
Yahoo!: http://conf.member.yahoo.com configuration file disclosure
Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program...
Oracle Demantra 12.2.1 - Arbitrary File Disclosure
Exploit for windows platform in category web applications Details: The Team discovered a Local File Include LFI vulnerability. A file inclusion vulnerability occurs when a file from the target system is injected into a page on the attacked server page. The vulnerable page is: /demantra/GraphServl...
Plex Media Server 0.9.9.2.374-aa23a69 - Multiple Vulnerabilities
Plex Media Server versions 0.9.9.2.374-aa23a69 and below suffer from authentication bypass and local file disclosure vulnerabilities. title: Authentication bypass SSRF and local file disclosure product: Plex Media Server vulnerable version: =0.9.9.3 impact: Critical homepage: http://www.plex.tv...
Plex Media Server 0.9.9.2.374-aa23a69 - Multiple Vulnerabilities
Plex Media Server 0.9.9.2.374-aa23a69 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authentication bypass SSRF and local file disclosure product: Plex Media Server vulnerable version:...
Plex Media Server 0.9.9.2.374-aa23a69 Bypass / File Disclosure
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authentication bypass SSRF and local file disclosure product: Plex Media Server vulnerable version: =0.9.9.3 impact: Critical homepage: http://www.plex.tv found: 2014-02-...
Plex Media Server 0.9.9.2.374-aa23a69 - Multiple Vulnerabilities
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authentication bypass SSRF and local file disclosure product: Plex Media Server vulnerable version: =0.9.9.3 impact: Critical homepage: http://www.plex.tv found: 2014-02-...
eshtery CMS 'FileManager.aspx'本地文件泄漏漏洞
Bugtraq ID:65740 CVE ID:CVE-2014-2069 eshtery CMS是一款内容管理系统。 eshtery CMS不正确过滤用户的输入，允许远程攻击者利用漏洞提交请求读取系统任意文件内容。 0 eshtery CMS 目前没有详细解决方案提供： http://eshtery.she7ata.com/projects/eshtery/ http://www.example.com/path/FileManager.aspx?file=E:\web\admin.asp...
Framework: XML External Entity (XXE) injection flaw
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...
eshtery CMS - 'FileManager.aspx' Local File Disclosure
source: https://www.securityfocus.com/bid/65740/info eshtery CMS is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on...
eshtery CMS - FileManager.aspx Local File Disclosure
eshtery CMS - FileManager.aspx Local File Disclosure source: https://www.securityfocus.com/bid/65740/info eshtery CMS is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain...
Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter
It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity XXE attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform oth...
Zimbra Collaboration Server skin Parameter Traversal Local File Inclusion
The Zimbra Collaboration Server installed on the remote host is affected by a file disclosure vulnerability because it fails to properly sanitize user-supplied input to the 'skin' parameter of '/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz'. This vulnerability could...
ASUS AiCloud Enabled Routers 12 Models - Authentication bypass and Sensitive file/path disclosure
ASUS routers, which are enabled with the AiCloud service SSL ports, are vulnerable to bypass of authentication and sensitive file disclosure. This vulnerability has been observed in all firmware versions, though the latest version increases the complexity of the attack. By sending a special craft...
Sophos Web Protection Appliance 3.7.8.1 File Disclosure
File disclosure vulnerability in Sophos Web Protection Appliance Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...
Opera browser for Android issue in handling intent scheme URL's
Overview Opera browser for Android contains an issue in the handling of intent scheme URL's. Takeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When a use...
CVE-2011-2725: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. dot dot sequences in a zip file...