Ubiquiti Inc.: Local File Disclosure (+XSS+CSRF) in AirOS 6.2.0 devices

There are certain end-points containing functionalities that are vulnerable to reflected cross site scripting XSS, allowing attackers to abuse the user' session information and/or account takeover of the admin user. Authenticated users can be persuaded to visit malicious web pages, which allows...

CVE-2019-14277

Axway SecureTransport 5.x through 5.3 or 5.x through 5.5 with certain API configuration is vulnerable to unauthenticated blind XML injection and XXE in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks i.e., SSRF...

Axway SecureTransport Code Issue Vulnerability

Axway SecureTransport is a suite of applications for the secure transfer of files and data from the French company Axway. Axway SecureTransport is vulnerable to a code issue. The vulnerability stems from an improperly designed or implemented code development process for a networked system or...

PT-2019-3866 · Fasterxml +3 · Jackson-Databind +3

Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x through 2.9.9 Description: A Polymorphic Typing issue was discovered in FasterXML jackson-databind. When Default Typing is enabled for an externally exposed JSON endpoint and the service has JDOM 1.x or...

uima: XML external entity expansion (XXE) can allow attackers to execute arbitrary code

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion XXE capability of various XML parsers. UIMA as part of its...

CVE-2019-4174

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158879...

CVE-2019-12154

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions...

CVE-2019-12154

XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions...

CVE-2019-9157

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

CVE-2019-9157

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

Arbitrary file deletion

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

CVE-2019-9157

Gemalto DS3 Authentication Server (also known as Ezio Server) contains a Local File Disclosure vulnerability tracked as CVE-2019-9157. The advisory data in the PacketStorm SEC Consult entry indicates vulnerable releases are Ezio DS3 server earlier than v3.1.0, with the fix released in v3.1.0. The...

CVE-2019-9157

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure...

Pornhub: SSRF and local file disclosure by video upload on http://www.youporn.com/

The researcher was successful in exploiting a vulnerability in 3rd encoding party library resulting in the execution of SSRF attacks and Local File Disclosure...

The vulnerability of the XML analyzer browser Internet Explorer, which allows a hacker to disclose protected information

The vulnerability of the XML browser analyzer Internet Explorer is related to a bug that restricts XML links to external objects. Exploiting this vulnerability can allow an attacker to gain access to local files and disclose protected information using a specially crafted MHT file MHTML Web Archi...

Internet Explorer XXE vulnerability alerts-a vulnerability alert-the black bar safety net

GMT 4 on 11 May, the Foreign Security Fellow at the John Page public disclosure Internet Explorer 11 XXE vulnerability, successful exploitation of the vulnerability will lead to local file disclosure. Microsoft learned of the vulnerability, given a”temporary non-fix”results. In view of the...

CVE-2019-8982

com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of local files and SSRF...

I is how to pass the ASP Secrets read Get 1. 7 million USD reward-vulnerability warning-the black bar safety net

ASP. NET application in the more common vulnerability is a local file disclosure. If you have never develop or use such technology, then the LFD exploit can be very difficult, and no practical effect. In this article, I describe how to attack a presence in the LFD vulnerability of the application...

LibreHealthIO LH-EHR Local File Disclosure Vulnerability

LibreHealthIO LH-EHR is an open source electronic health record and medical practice management application. A local file disclosure vulnerability exists in the import of templates in versions prior to LibreHealthIO LH-EHR REL-2.0.0. An attacker can exploit this vulnerability to disclose sensitiv...

CVE-2018-1000645

LibreHealthIO lh-ehr version REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server. This attack appear to be exploitable via User controlled variable in import...