1401 matches found
GHSA-7PX3-6F6G-HXCJ XML external entity expansion in org.apache.solr:solr-core
This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion XXE in Solr config files currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file. In addition, Xinclude functionality provided in these config files is als...
h1-5411-CTF: MemeCTF serial exploitation to local file read to Papertrail access via API-token leakage and more
Hi there dear CTF staff! First of all a huge thank you for the great challenge you put up! I've found it super exciting and the learning curve has been steep. For this case, I was first wondering if this is a part of the actual CTF, but after some inspecting, it surely doesn't seem so! I did even...
h1-5411-CTF: H1-5411 CTF Writeup
So, Hackerone posted a tweet about the Meme CTF Where barcode was in the tweet image by scanning it and decoding from hex I found this link : https://h1-5411.h1ctf.com/ where we can create/generate a memes and for generating the meme this was used form GitHub which i found in source code analysis...
h1-5411-CTF: RCE via Local File Read -> php unserialization-> XXE -> unpickling
Summary: It was possible to escalate to Remote Code Execution via different bugs such as local file read, php object injection, XML External Entity and Un-Pickling of Python serialized object. Description: Using local file read it was discovered that the php code was vulnerable to php object...
openSUSE Security Update : cups (openSUSE-2018-852)
This update for cups fixes the following issues : The following security vulnerabilities were fixed : - Fixed a local privilege escalation to root and sandbox bypasses in the scheduler - CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend bsc1096405 - CVE-2018-4181: Limited...
CVE-2018-3770: Improper Limitation of a Pathname to a Restricted Directory
A path traversal exists in markdown-pdf version 9.0.0 that allows a user to insert a malicious html code that can result in reading the local files...
CVE-2018-8026
This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion XXE in Solr config files currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file. In addition, Xinclude functionality provided in these config files is als...
JasperReports - Authenticated File Read Vulnerability
Exploit for multiple platform in category web applications TIBCO’s JasperReports string = wrapper.getParameterValues"page" To: getResource @ DirResourceSet.java:101 file = new File/home/rhino/jasperreports...mcat/webapps/jasperserver,"/WEB-INF/jsp/modules/administer/adminImport.jsp" Due to a lack...
ModbusPal XML External Entity Injection Vulnerability
ModbusPal is a MODBUS simulator written in Java with a replicated MODBUS environment. An XML external entity injection vulnerability exists in ModbusPal version 1.6b. A remote attacker can exploit this vulnerability by sending a specially crafted .xmpp or .xmpa file to the user to obtain the...
Nagios XI Directory Traversal Vulnerability
Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A security vulnerability exists in Nagios XI version 5.4.13. An attacker can exploit the vulnerability to...
CVE-2018-10553: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings...
chromium-browser: Lack of meaningful user interaction requirement before file upload
Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page...
DEBIAN-CVE-2018-1308
This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion XXE in the &dataConfig= parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the...
CVE-2018-1308: Improper Restriction of XML External Entity Reference
This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion XXE in the &dataConfig= parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the...
CVE-2017-1756
IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856...
CVE-2017-1478
IBM Security Access Manager Appliance 9.0.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 128613...
CVE-2017-1478
Summary: IBM Security Access Manager Appliance 9.0.0 is affected by a local information-disclosure vulnerability where web pages can be stored locally and read by another user on the same system. This affects IBM Security Access Manager Appliance versions 9.0 through 9.0.3.1. The root cause invol...
Open-Xchange: Arbitrary local system file read on open-xchange server
Hi, Summary: I found a vulnerability that can read arbritary local file and also internal resource on Open-Xchange server. Description: I can create an crafted odt file and can successfully read any local files on Open-Xchange server when previewing this odt file. Steps to Reproduce: Here is the...