CVE-2020-14056

Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows attackers to read arbitrary local files and interact with arbitrary third-party services...

CVE-2020-14056: Server-Side Request Forgery (SSRF)

Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch functionality. This allows attackers to read arbitrary local files and interact with arbitrary third-party services...

CVE-2020-14204: Improper Restriction of XML External Entity Reference

In WebFOCUS Business Intelligence 8.0 SP6, the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to /ibiapps/WFServlet.cfg because XML external entity injection is possible. This is related to making changes t...

Unauthorized Local File Read

octobercms is vulnerable to unrestricted local file read. The vulnerability is possible because it does not restrict the file path to read the files under the assets directory, allowing any authenticated backend user with the cms.manageassets permission to read local files of an October CMS serve...

October CMS Arbitrary File Read Vulnerability (CNVD-2020-38885)

October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS composer versions 1.0.319 and later fixed in version 1.0.466. An attacker could exploit the vulnerability to read local files on the Octob...

CVE-2020-5295 Local File read vulnerability in OctoberCMS

In OctoberCMS october/october composer package versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the cms.manageassets permission. Issue has...

CVE-2020-5295: Improper Control of Filename for Include/Require Statement in PHP Program

In OctoberCMS october/october composer package versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the cms.manageassets permission. Issue has...

Cisco Hosted Collaboration Mediation Fulfillment Code Issue Vulnerability

Cisco Hosted Collaboration Mediation Fulfillment HCM-F is a core management component of a Hosted Collaboration Solution HCS from Cisco. The product provides inventory management, license management, and service provider toolkit. A code issue vulnerability exists in Cisco Hosted Collaboration...

SSRF vulnerability in weiphp5.0 API.php page

WeiPHP is an open source WeChat public platform development framework, can easily build a personal WeChat public account operation platform. SSRF vulnerability exists in the weiphp5.0 API.php page, which can be exploited to read any local file, perform intranet port scanning, intranet web...

VISAM VBASE Editor and VBASE Web-Remote Module Path Traversal Vulnerability

VISAM VBASE is a data acquisition and monitoring system from VISAM, Germany, VBASE Editor is an editor and VBASE Web-Remote Module is a web-based remote module. A path traversal vulnerability exists in VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module due to a failure of the program...

CVE-2020-6809: Undefined Security Weakness

When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files. This vulnerability affects Firefox 74...

CVE-2019-20191: Improper Restriction of XML External Entity Reference

Oxygen XML Editor 21.1.1 allows XXE to read any file...

USN-4294-1 OpenSMTPD vulnerabilities

It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could use this vulnerability to execute arbitrary shell commands as any non-root user. CVE-2020-8794 It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An...

Race condition

OpenSMTPD before 6.6.4 allows local users to read arbitrary files e.g., on some Linux distributions because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c...

CVE-2020-8793

OpenSMTPD before 6.6.4 allows local users to read arbitrary files e.g., on some Linux distributions because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c...

UBUNTU-CVE-2020-8793

OpenSMTPD before 6.6.4 allows local users to read arbitrary files e.g., on some Linux distributions because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c...

CVE-2019-4465

CVE-2019-4465 affects IBM Cloud Pak System 2.3 and 2.3.0.1, where Web pages can be stored locally and read by another user on the same system. This is due to a local storage flaw in Cloud Pak System Manager. Impact is information exposure of stored web pages. Remediation: upgrade to Cloud Pak Sys...

CVE-2019-4465: Improper Privilege Management

IBM Cloud Pak System 2.3 and 2.3.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 163774...

Mail.ru: SSRF on fleet.city-mobil.ru leads to local file read

SSRF/LFR vulnerability via image retrieving functionality of operator's cabinet of fleet.city-mobil.ru...

CVE-2019-14678

SAS XML Mapper 9.45 has an XML External Entity XXE vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects...