2968 matches found
DEBIAN-CVE-2017-3157
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user in...
CVE-2017-10888
BOOK WALKER for Windows Ver.1.2.9 and earlier, BOOK WALKER for Mac Ver.1.2.5 and earlier allow an attacker to access local files via unspecified vectors...
Design/Logic Flaw
BOOK WALKER for Windows Ver.1.2.9 and earlier, BOOK WALKER for Mac Ver.1.2.5 and earlier allow an attacker to access local files via unspecified vectors...
CVE-2017-10888
BOOK WALKER for Windows Ver.1.2.9 and earlier, BOOK WALKER for Mac Ver.1.2.5 and earlier allow an attacker to access local files via unspecified vectors...
CVE-2017-13801
An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Dictionary Widget" component. It allows attackers to read local files if pasted text is used in a search...
CVE-2017-5084
Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...
CVE-2017-5084
Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...
UBUNTU-CVE-2017-5084
Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...
CVE-2017-5084
Removed by vendor...
CVE-2017-12629
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...
CVE-2017-12629
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...
Marp vulnerable to improper access control in JavaScript execution
Overview Marp is a tool to create a presentation PDF with Markdown. Marp executes JavaScript inside the Markdown contents. Marp allows JavaScript to access local resources and files CWE-284. Keitaro Yamazaki of Kyoto University reported this vulnerability to IPA. JPCERT/CC coordinated with the...
Mozilla Firefox File Read Vulnerability
Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 56. The vulnerability can be exploited by remote attackers to open locally stored files with the help of malicious web...
Zomato: SSRF in https://www.zomato.com████ allows reading local files and website source code
@nbsp found a SSRF vulnerability which leads to read local files from the web server source code & system files. We have resolved the issue quickly and rewarded the researcher...
The vulnerability of the mod_ssl module in the Apache HTTP Server allows a hacker to gain access to local files.
The vulnerability of the modssl module in the Apache HTTP Server is related to NULL pointer dereferencing errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to local files by calling the external module function aphookprocessconnection during an HTTPS...
CVE-2017-8918
XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template.xml file...
Arbitrary Code Execution
doctrine/annotations is vulnerable to arbitrary code execution. The application does not properly enforce file permissions, allowing a malicious user to inject and execute arbitrary local files...
Xxe
XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import...
CVE-2017-9095
CVE-2017-9095 affects Diving Log 6.0 and is an XML External Entity (XXE) vulnerability in the dive.xml import workflow (Subsurface import). An attacker can disclose local files via a crafted dive.xml file. Public exploit references document an XXE payload and steps to exfiltrate data to a remote ...