McAfee ePolicy Orchestrator Directory Traversal and Cross-Site Scripting Vulnerability (CNVD-2018-07436)

McAfee ePolicy Orchestrator ePO is an industry-leading systems security management solution that helps organizations effectively defend against a wide range of malicious threats and attacks. McAfee ePolicy Orchestrator versions 5.9,5.3.2,5.3.1,5.3.0 have directory traversal and cross-site scripti...

McAfee ePolicy Orchestrator Directory Traversal and Cross-Site Scripting Vulnerability

McAfee ePolicy Orchestrator ePO is an industry-leading systems security management solution that helps organizations effectively defend against a wide range of malicious threats and attacks. Directory traversal and cross-site scripting vulnerabilities exist in McAfee ePolicy Orchestrator versions...

Unencrypted Password Store

build-publisher stores passwords unencrypted. Anyone with access to the local file system can access credentials to other Jenkins systems. The credentials are also transmitted in plaintext which exposes them to various other attacks...

CVE-2017-10888

BOOK WALKER for Windows Ver.1.2.9 and earlier, BOOK WALKER for Mac Ver.1.2.5 and earlier allow an attacker to access local files via unspecified vectors...

CVE-2017-10888

CVE-2017-10888 affects BOOK WALKER for Windows (v1.2.9 and earlier) and Mac (v1.2.5 and earlier). The connected documents describe an information-disclosure vulnerability (CWE-200) that may allow an attacker to access local files, via unspecified vectors, on these platforms. The underlying issue ...

BOOK WALKER Information Disclosure Vulnerability

BOOK WALKER for Windows and BOOK WALKER for Mac are both products of BOOK WALKER, a Japanese company. BOOK WALKER for Windows is a set of e-book software based on the Windows platform.BOOK WALKER for Mac is a set of e-book software based on the Mac platform. BOOK WALKER for Mac is a set of e-book...

CVE-2017-13801

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Dictionary Widget" component. It allows attackers to read local files if pasted text is used in a search...

Apple macOS High Sierra Dictionary Widget Local File Vulnerability

Apple macOS High Sierra is a dedicated operating system developed by Apple for Mac computers.Dictionary Widget is one of the components of the Dictionary Widget. A security vulnerability exists in the Dictionary Widget component in Apple macOS High Sierra versions prior to 10.13.1. An attacker...

UBUNTU-CVE-2017-12629

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...

UBUNTU-CVE-2017-7812

If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open. This can allow malicious web content to open a locally stored file through "file:" URLs. This vulnerability affects Firefox 56...

Blackware Dive Assistant XML External Entity Injection Vulnerability

Blackware Dive Assistant desktop version is a suite of dive assistant software from Blackware UK. The software is used to record, analyze and plan dive tools, dive tables etc. An XML external entity injection vulnerability exists in version 8.0 of Blackware Dive Assistant Desktop Edition. A remot...

CVE-2017-9095

XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import...

PT-2017-18698 · Diving Log · Diving Log

Name of the Vulnerable Software and Affected Versions: Diving Log version 6.0 Description: The issue allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import. This is related to an XXE XML External Entity issue. Recommendations: F...

NoMachine for Mac OS X and Linux Elevation of Privilege Vulnerability

NoMachine for Mac OS X and Linux is a remote desktop access tool from Luxembourg-based NoMachine for Mac OS X and Linux platforms. A security vulnerability exists in the server utility in versions of NoMachine prior to 5.3.10 for Mac OS X and Linux. The vulnerability can be exploited to gain...

CVE-2017-12763

An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files...

CVE-2017-12763

An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files...

Dokodemo eye Smart HD SCR02HD Directory Traversal Vulnerability

Dokodemo eye Smart HD SCR02HD is a wireless monitor from NIPPON ANTENNA. A directory traversal vulnerability exists in Dokodemo eye Smart HD SCR02HD, which can be exploited by an attacker to read arbitrary local files on the product...

xmlsec1: xmlsec vulnerable to external entity expansion

It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion XXE along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service...

CVE-2017-11149

Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...

Tor: Access to local file system using javascript

Issue : Access to local file system using javascriptslightly xss on server side The browser can access the local files using iframes with a local html file. this is very normal and often used for local web development but javascript shouldn't be able to get the content of that iframe because this...