CVE-2014-2383

dompdf.php in dompdf before 0.6.1, when DOMPDFENABLEPHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the inputfile parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the...

UBUNTU-CVE-2014-0054

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML Extern...

CVE-2014-0054

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML Extern...

Camel: XML eXternal Entity (XXE) flaw in XSLT component

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...

CVE-2014-2535

Directory traversal vulnerability in McAfee Web Gateway MWG 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remote authenticated users to read arbitrary files via a crafted request to the web filtering port...

CVE-2013-1939

The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ backslash character...

CVE-2014-0630

CVE-2014-0630 affects EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11. The issue allows remote authenticated users to retrieve arbitrary files by modifying the imaging-service URL used to stream content, indicating a failure in input/url validation within the imaging servic...

IBM Algo One Algo多个安全漏洞

CVE ID:CVE-2013-6299、CVE-2013-6300、CVE-2013-6301、CVE-2013-6302、CVE-2013-6303、CVE-2013-6318、CVE-2013-6319、CVE-2013-6320、CVE-2013-6331、CVE-2013-6333 IBM Algo One是一个风险管理软件解决方案。 IBM Algo One存在多个安全漏洞： 1，应用程序不正确校验用户权限，允许攻击者利用漏洞获取受限内容。 2，存在多个跨站脚本漏洞，允许攻击者构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。...

Ganesha Digital Library Multiple Vulnerabilities

Ganesha Digital Library is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Framework: XML External Entity (XXE) injection flaw

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...

CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

GLSA-201402-07 : Freeciv: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201402-07 Freeciv: User-assisted execution of arbitrary code The Lua component of Freeciv does not restrict which modules may be loaded by scenario scripts. Impact : A remote attacker could entice a user to open a specially crafte...

VulnCheck KEV: CVE-2013-1904

Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the value parameter for the genericmessagefooter setting in a save-perf action to index.php, as exploite...

CVE-2014-1626

XML External Entity XXE vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file...

CVE-2014-1626

CVE-2014-1626 affects the MARC::File::XML component of MARC-XML for Perl, before version 1.0.2, as used by Evergreen, Koha, and perl4lib. The vulnerability is an XML External Entity (XXE) issue that allows a context-dependent attacker to read arbitrary files via a crafted XML input. Public refere...

DEBIAN-CVE-2013-7315

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB,...

Design/Logic Flaw

The image creation configuration in aaabase before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow...

MGASA-2014-0004 Updated librsvg and gtk+3.0 packages fix security vulnerability

librsvg before version 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference CVE-2013-1881. gtk+3.0 has been patched to cope with the changes in SVG loading due to the fix in librsvg...

CVE-2013-4069

IBM SPSS Collaboration and Deployment Services is affected by CVE-2013-4069. The Deployment Portal mishandles XML external entities, enabling remote attackers to read arbitrary files via an XML external entity declaration with an entity reference. Affected versions: 4.2.1 before 4.2.1.3 IF3 and 5...

CVE-2013-6708

Cisco Cloud Portal 9.4 contains an unauthenticated file download flaw where an attacker can read files via direct browser request due to insufficient access controls. The issue is documented in CVE-2013-6708 and Cisco’s advisory (Cisco-SA-20131209-CVE-2013-6708). Affected component is the web int...