Tor: Access to local file system using javascript

Issue : Access to local file system using javascriptslightly xss on server side The browser can access the local files using iframes with a local html file. this is very normal and often used for local web development but javascript shouldn't be able to get the content of that iframe because this...

The vulnerability of the WideVine DRM component for the Android operating system allows a violator to gain access to local files.

The vulnerability of the WideVine DRM component for the Android operating system is related to pointer assignment errors. Exploiting this vulnerability could allow a malicious actor to gain access to local files remotely...

The vulnerability of the TrustZone component of the Android operating system allows a hacker to gain access to local files.

The vulnerability of the TrustZone component in the Android operating system is related to pointer dereferencing errors. Exploiting this vulnerability can allow a remote attacker to gain access to local files...

CVE-2017-2182

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2181...

CVE-2016-9710

IBM Predictive Solutions Foundation formerly PMQ could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a file from the local system, which could allow the attacker to obtain sensitive information. IBM X-Force ID: 119618...

WordPress plugin "Booking Calendar" vulnerable to directory traversal

Overview The WordPress plugin "Booking Calendar" provided by wpdevelop contains a directory traversal vulnerability CWE-22. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A local file outside of th...

UBUNTU-CVE-2017-5454

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird 52.1,...

The vulnerability of the Windows operating system, which allows a perpetrator to gain access to local files

The vulnerability of the Windows operating system’s server service is related to pointer assignment errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to local files using specially crafted SMBv2 or SMBv3 packets...

CVE-2017-2426

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "iBooks" component. It allows remote attackers to obtain sensitive information from local files via a file: URL in an iBooks file...

CVE-2017-1154

IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to files in the local environment which should not be viewed by application users. IBM Reference : 1999892...

NetIQ Access Manager Information Disclosure Vulnerability

NetIQ Access Manager provides a simple, secure, and scalable solution to handle all your Web access needs. An information disclosure vulnerability exists in NetIQ Access Manager. The vulnerability is caused due to ineffective filtering of incoming XML requests when parsed by the NAM Identity...

NetIQ Access Manager Information Disclosure Vulnerability (CNVD-2017-04728)

NetIQ Access Manager provides a simple, secure, and scalable solution to handle all your Web access needs. NetIQ Access Manager Information Disclosure Vulnerability. Since Access Manager 4.1 and 4.2 support risk-based authentication on the Identity Server. An attacker can obtain local file...

Tiki Wiki CMS Arbitrary File Disclosure Vulnerability

Tiki Wiki CMS Groupware is a suite of open source content management and portal applications from the Tiki software community that can be used to create web applications, portals, corporate intranets, extranets, and more. An arbitrary file disclosure vulnerability exists in Tiki Wiki CMS version...

USN-3217-1 network-manager-applet vulnerability

Frederic Bardy and Quentin Biguenet discovered that network-manager-applet incorrectly checked permissions when connecting to certain wireless networks. A local attacker could use this issue at the login screen to access local files...

The vulnerability of Google Chrome browser allows a perpetrator to gain access to local files.

The vulnerability of the Histogram component in Google Chrome browser is related to pointer assignment errors. Exploiting this vulnerability can allow a malicious actor to gain access to local files through a specially crafted HTML page...

WBCE CMS vulnerable to directory traversal

Overview WBCE CMS provided by WBCE Team is an open-source Contents Management System CMS. WBCE CMS contains a directory traversal vulnerability CWE-22. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...

Openpyxl XML External Entity Injection Vulnerability

Openpyxl is a Python library for reading and writing Excel 2010. An XML external entity injection vulnerability exists in Openpyxl version 2.4.1. A remote attacker can exploit this vulnerability to read a local file with the help of a specially crafted document, resulting in a denial of service t...

CubeCart vulnerable to directory traversal

Overview CubeCart from CubeCart Limited is an open source system for creating online shopping websites. CubeCart contains a directory traversal vulnerability CWE-22. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

CVE-2016-9380

The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file...

CVE-2016-5220

PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file...