1401 matches found
From PhantomJS picture rendering of XSS vulnerabilities to the SSRF/local file read vulnerability-vulnerability warning-the black bar safety net
One, Foreword Recently I was invited to study a vulnerability reward project, this project can be based on user input to generate a picture, in order for users to download. After a period time of exploring, I found a way to exploit the path, you can use the picture inside theXSSthe vulnerability ...
CVE-2016-5893
IBM Sterling B2B Integrator Standard Edition 5.2 is affected by CVE-2016-5893 where the product allows web pages to be stored locally and read by a different user on the same system, enabling local info disclosure. Affected product/version: IBM Sterling B2B Integrator Standard Edition 5.2. Root c...
CVE-2016-5893: Exposure of Sensitive Information to an Unauthorized Actor
IBM Sterling B2B Integrator Standard Edition 5.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 115336...
OV3 Online Administration Directory Traversal Vulnerability
OV3 Online Administration is an online administration platform. A directory traversal vulnerability exists in OV3 Online Administration. This allows an attacker to read arbitrary files from local resources via a directory traversal attack...
Dropbear Symlink Local File Read Vulnerability (CVE-2017-9079)
Dropbear is prone to a local file read vulnerability via symlinks. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2017-7503
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed...
Information leakage vulnerability in several Mozilla products
Mozilla Firefox, Firefox ESR and Thunderbird are all developed by the Mozilla Foundation.Firefox is an open source web browser, Firefox ESR is an extended support version of Firefox.Thunderbird is a standalone email client from the Mozilla Thunderbird is a separate email client from Mozilla...
CVE-2016-6097
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system...
DEBIAN-CVE-2017-5595
A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile, which allows an authenticated attacker to read local system files e.g., /etc/passwd in the context of the web server user www-dat...
CVE-2016-3024
IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system...
CVE-2016-3024: Exposure of Sensitive Information to an Unauthorized Actor
IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system...
CVE-2016-5212
Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page...
CVE-2016-5220: Exposure of Sensitive Information to an Unauthorized Actor
PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to read local files via a crafted PDF file...
CVE-2016-5212: Exposure of Sensitive Information to an Unauthorized Actor
Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page...
XStream: enabled processing of external entities
It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks...
Design/Logic Flaw
A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOADFILE...
TRS Infogate Plugin SSRF Vulnerability
TRS Infogate is a general-purpose plug-in developed by TORS for application on WCM and IDS platforms of national governments, enterprises and institutions. TRS Infogate plug-in page infogate/customer/system/wcmurltest.jsp SSRF vulnerability. The page in the infogate/customer/system directory can...
CVE-2016-5746
CVE-2016-5746 affects libstorage, libstorage-ng, and yast-storage. The vulnerability arises from improperly storing passphrases for encrypted storage devices in a temporary file on disk (example path: /tmp/libstorage-XXXXXX/pwdf), which could allow local users to read sensitive information. Conne...
Paessler PRTG Network Monitor Local File Read Vulnerability
Paessler PRTG Network Monitor is a suite of network monitoring software. A security vulnerability exists in Paessler PRTG Network Monitor that could be exploited by a remote attacker to read files stored on a local disk with account access privileges...
