Information Disclosure

glance is vulnerable to information disclosure. A remote attacker is able to access and retrieve arbitrary files in a dot directory within the web server directory via URIs such as /.git/HEAD or /.got/logs/HEAD...

The vulnerability of the CLI component of Cisco Enterprise Network Function Virtualization Infrastructure (NFVIZ) software allows a attacker to access system configuration files.

The vulnerability of the CLI component of Cisco Enterprise Network Function Virtualization Infrastructure NFVIZ software lies in insufficient validation of input data. Exploiting this vulnerability can allow attackers to access system configuration files through a specially crafted request...

CVE-2019-8389

A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, accessible by everyone on the same Wi-Fi network. An attacker can send the POST parameters downfiles and cur-folder with a crafted ../ payload...

CVE-2019-1647

A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, adjacent attacker to bypass authentication and have direct unauthorized access to other vSmart containers. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit thi...

Apache Thrift Node.js static web server sandbox escape

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path...

CVE-2018-16867

A flaw was found in qemu Media Transfer Protocol MTP before version 3.1.0. A path traversal in the in usbmtpwritedata function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lea...

Directory Traversal Vulnerability in 56iq Digital Signage Software Frontend

56iq digital signage software is a digital signage content creation software, used to create exciting programs in plasma liquid crystal LCD flat-panel TVs, LED screens, projection equipment and other multimedia terminals playback and touch interactive applications. A directory traversal...

Authentication flaw

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246...

CVE-2018-11062

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default...

About the security content of macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra

About the security content of macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra This document describes the security content of macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra. About Apple security updates For o...

Mozilla Firefox ESR < 60.3 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox ESR installed on the remote macOS host is prior to 60.3. It is, therefore, affected by multiple vulnerabilities : - During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the...

Mozilla: WebExtension local file permission check bypass

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This...

Mozilla Firefox Security Advisories (MFSA2018-25, MFSA2018-27) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Cisco Wireless LAN Controller Software Directory Traversal Vulnerability

Cisco Wireless LAN Controller WLC is a wireless LAN controller product from Cisco USA. The product provides security policy, intrusion detection and other functions in the wireless LAN. A directory traversal vulnerability exists in Cisco Wireless LAN Controller Software due to a failure to proper...

Web Servers Code Execution Over HTTP Request Parameters (CVE-2017-17055)

A cross-site scripting vulnerability exists on different web servers. The vulnerability is due to an input validation error in the parameters in the request URL. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server...

Directory Traversal

camel-mail is vulnerable to a directory traversal attack. The library does not properly sanitize the file path, allowing a malicious user to gain access to the files on the system...

Authentication flaw

Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can allow attackers to bypass Windows authentication and execute commands on the system with the privileges of Pulse Secure Client. The attacker must interrupt the client's network...

FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection

FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection Title: FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection Author: hyp3rlinx Date: 2018-09-01 Vendor: www.eventlogxp.com Software: https://eventlogxp.com/download.php Affected Component: elex.exe CVE:...

FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection Vulnerability

Exploit for windows platform in category web applications Title: FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection Author: hyp3rlinx Vendor: www.eventlogxp.com Software: https://eventlogxp.com/download.php Affected Component: elex.exe CVE: N/A Description: Upon opening a...

ZZZCMS website builder system suffers from overstepping access vulnerability

zzcms is asp language to do free open-source station-building system, mainly facing the majority of webmasters to use. ZZZCMS website builder system exists overstepping the right to access the vulnerability, the attacker can use the vulnerability overstepping the right to access sensitive files...