PT-2017-6794

Name of the Vulnerable Software and Affected Versions Download Zip Attachments plugin version 1.0 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by including a .. dot dot in the File parameter to the "download.php" endpoint...

CVE-2017-9149

Metadata Anonymisation Toolkit MAT 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation from the Nautilus contextual menu, which allows context-dependent attackers to obtain sensitive information by reading a file for which cleaning had been attempted...

CVE-2017-5214

The Codextrous B2J Contact aka b2jcontact extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This makes it easier to read arbitrary uploaded files...

Arbitrary File Read Vulnerability in the Basename Function of the SDCMS errorcontroller.php Page

SDcms is a content management system developed by Suzhou Fireworks Network Technology Co. SDCMS errorcontroller.php page basename function has an arbitrary file reading vulnerability, an attacker can use the vulnerability to read arbitrary files to obtain sensitive information...

Zyxel P-660HW-61 Firmware < 3.40(PE.11)C0 Router - Local File Inclusion

Exploit Title: Zyxel P-660HW-61 3.40PE.11C0 - Local File Inclusion Date: 2-05-2017 Exploit Author: ReverseBrain Contact: https://www.twitter.com/ReverseBrain Vendor Homepage: https://www.zyxel.com Software Link: ftp://ftp.zyxel.com/P-660HW-61/firmware/P-660HW-613.40PE.11C0.zip Version: 3.40PE.11C...

Directory traversal

Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2017-7646

SolarWinds Log & Event Manager (LEM) prior to 6.3.1 Hotfix 4 allows an authenticated user to browse the server filesystem and read arbitrary files. Risk details are not expanded beyond this description in the provided documents. Remediation: upgrade to 6.3.1 Hotfix 4 or newer where indicated.

CVE-2015-8276

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to read arbitrary files via crafted EDOC files...

CVE-2014-2960

This CVE concerns Vision Critical before 2014-05-30, where an information-disclosure vulnerability allowed reading arbitrary files via unspecified vectors, demonstrated with image and configuration files. Affected product: Vision Critical cloud-based intelligent user management platform (pre-2014...

CVE-2015-8276

LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 contain an information disclosure vulnerability that allows an attacker to read arbitrary files via specially crafted EDOC files. The issue is described across connected sources (CNVD-2017-16012, NVD CVE-2015-8276). The root cause is inf...

CVE-2017-0360

fileopen in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242...

The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a hacker to gain access to file readings.

The vulnerability of the McAfee VirusScan Enterprise antivirus software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to remotely read files from the web server...

CVE-2016-9605

A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation...

Multiple vulnerabilities in jeecms JSPGOU

jspgou is based on java technology development of e-commerce management software. jeecms JSPGOU has stored cross-site scripting, CSRF and arbitrary file reading vulnerabilities. Due to the front-end input filtering is not strict, the background operation does not verify the source , allowing...

CVE-2016-10187

The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript...

CVE-2017-5583

The CVE-2017-5583 vulnerability affects Palo Alto Networks PAN-OS prior to 6.1.16, 7.0.x prior to 7.0.13, and 7.1.x prior to 7.1.8. It is a post-authentication information-disclosure flaw in the Management Web Interface that allows remote authenticated users to read arbitrary files via unspecifie...

Design/Logic Flaw

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...

CVE-2016-8017

CVE-2016-8017 is a concrete vulnerability in McAfee VirusScan Enterprise for Linux (VSEL) up to version 2.0.3 where the web interface handles special elements (tplt) in user input, enabling an authenticated remote attacker to read files on the webserver. The underlying issue is a Special Element ...

Multiple IP-Cameras (P2P) WIFICAM Cameras Multiple Vulnerabilities

Multiple IP-Camera devices are prone to multiple vulnerabilities. This vulnerability was known to be exploited by the IoT Botnet SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

The vulnerability of Google Chrome allows a hacker to install a malicious extension.

The vulnerability of Google Chrome’s DevTools URLs component is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to install a malicious extension and gain access to file readings through a specially crafted HTML page...