WordPress WP Database Backup File Read Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WP Database Backup is a data backup plugin used in it. A security vulnerability exists in WordPress WP Database Backup 5.5 and earlier...

PT-2020-07: Arbitrary file reading in Oracle WebLogic Server

A vulnerability in Oracle WebLogic Server allows remote attackers to read local files in the context of the web server using a service URL and a specially crafted request. To exploit the vulnerability an adversary should have an administrative account. Access to the administrative panel is not...

Authorization

All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. Attackers could obtain log file information without authorization, causing the disclosure of sensitive information...

CVE-2019-3429

CVE-2019-3429 affects ZTE ZXCLOUD GoldenData VAP, with all versions prior to 4.01.01.02 vulnerable to a file-read vulnerability that allows an attacker to obtain log file information and disclose sensitive data. The linked sources consistently identify the affected product and version boundary (p...

CVE-2018-14865

The CVE-2018-14865 case concerns Odoo, specifically the Report engine in Odoo Community versions 9.0–11.0 and earlier and Odoo Enterprise versions 9.0–11.0 and earlier. The vulnerability stems from the Report engine not using secure options when passing documents to wkhtmltopdf, which can allow a...

[SECURITY] [DLA 1798-1] jackson-databind security update

Package : jackson-databind Version : 2.4.2-2+deb8u6 CVE ID : CVE-2019-12086 Debian Bug : 929177 A Polymorphic Typing issue was discovered in jackson-databind, a JSON library for Java. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint...

CVE-2019-11510

In Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability . Recent assessments: dmelcher5151 at April 15, 2020 4:11pm UTC reported...

Improper access control

Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain...

MGASA-2018-0188 Updated squirrelmail packages fix CVE-2018-8741

Updated squirrelmail packages fix security vulnerabilities: Filenames of attachment files are not sanitized, so attackers could read arbitrary files. CVE-2018-8741...

CVE-2017-3157

By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user in...

CVE-2017-12586

SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users...

CVE-2017-9295

CVE-2017-9295 describes an XML External Entity (XXE) information disclosure affecting Hitachi Device Manager (before 8.5.2-01) and Hitachi Replication Manager (before 8.5.2-00). The vulnerability allows authenticated remote users to read arbitrary files due to a flaw in how XML input is processed...

CVE-2015-5382

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the alt parameter when uploading a vCard...

Directory traversal

Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2015-8276

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to read arbitrary files via crafted EDOC files...

CVE-2015-8276

LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 contain an information disclosure vulnerability that allows an attacker to read arbitrary files via specially crafted EDOC files. The issue is described across connected sources (CNVD-2017-16012, NVD CVE-2015-8276). The root cause is inf...

CVE-2016-10187

The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript...

CVE-2017-5583

The CVE-2017-5583 vulnerability affects Palo Alto Networks PAN-OS prior to 6.1.16, 7.0.x prior to 7.0.13, and 7.1.x prior to 7.1.8. It is a post-authentication information-disclosure flaw in the Management Web Interface that allows remote authenticated users to read arbitrary files via unspecifie...

The vulnerability of Google Chrome allows a hacker to install a malicious extension.

The vulnerability of Google Chrome’s DevTools URLs component is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to install a malicious extension and gain access to file readings through a specially crafted HTML page...

CVE-2016-5220

CVE-2016-5220: PDFium in Chromium/Google Chrome allowed local file access via a crafted PDF, affecting Chrome/Chromium up to version 55.0.2883.75 (Mac/Win/Linux) and 55.0.2883.84 on Android. Affected component is PDFium; the underlying issue is a local file access path in PDF rendering. Remediati...