Information disclosure

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of local files via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."...

CVE-2016-8582

A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOADFILE...

WSO2 Identity Server CSRF And XXE Vulnerabilities

WSO2 Identity Server is prone to a XML external entity XXE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Joomla Sensitive Core Files Information Disclosure

An information disclosure vulnerability exists in multiple Joomla Plugins and themes. Successful exploitation of this vulnerability could allow a remote attacker to download local files, and may lead to disclosure of database credentials...

Code injection

Mozilla Firefox before 48.0 does not properly restrict drag-and-drop aka dataTransfer actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site...

CVE-2016-5266

Mozilla Firefox before 48.0 does not properly restrict drag-and-drop aka dataTransfer actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site...

CVE-2016-5266

Mozilla Firefox before 48.0 does not properly restrict drag-and-drop aka dataTransfer actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site...

Mozilla: Same-origin policy violation using local HTML file and saved shortcut file (MFSA 2016-80)

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS UXSS attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same loca...

The vulnerability of Microsoft XML Core Services allows a malicious attacker to compromise the confidentiality of protected information.

Vulnerability allows a malicious actor to gain access to files of the user’s local file system or to the content of web domains in which the user is currently authenticated. To exploit this vulnerability, the user must navigate to specially crafted web content designed to trigger MSXML through...

The vulnerability of the Internet Explorer browser allows a malicious individual to gain unauthorized access to confidential information in local files.

The Internet Explorer browser contains a vulnerability caused by the fact that the program cannot properly check permissions when installing local files. Exploiting this vulnerability allows a malicious individual to gain unauthorized access to confidential information in local files...

ImageMagick Pseudo Protocol Use Local Information Disclosure (CVE-2016-3717)

An Information Disclosure vulnerability exists in ImageMagick. A remote attacker may exploit this issue by using one of ImageMagick's pseudo protocols. Successful exploitation would allow attackers to read local files from the target user...

Debian DLA-484-1 : graphicsmagick security update (ImageTragick)

Several security vulnerabilities were discovered in graphicsmagick a tool to manipulate image files. GraphicsMagick is a fork of ImageMagick and also affected by vulnerabilities collectively known as ImageTragick, that are the consequence of lack of sanitization of untrusted input. An attacker wi...

Moderate: Red Hat Security Advisory: openstack-heat security advisory

Updated OpenStack Orchestration packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 6.0 Juno for RHEL 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, whic...

Mozilla Firefox and Firefox ESR Arbitrary File Overwrite Vulnerability

Firefox is an open source Web browser ; Firefox ESR is an extended support version of Firefox.Graphite is a set of Python language , written using the Django framework for enterprise-class open source system monitoring tools . Mozilla Firefox and Firefox ESR have a security vulnerability in the...

Debian Security Advisory DSA 3510-1 (iceweasel - security update)

Multiple security issues have been found in Iceweasel, Debian OpenVAS Vulnerability Test $Id: deb3510.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3510-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2016 Greenbone Networks Gm...

DSA-3510-1 iceweasel - security update

Bulletin has no description...

Memory corruption when modifying a file being read by FileReader — Mozilla

Security researcher Oriol reported memory corruption when local files are modified by either the user or another program at the same time being read using the FileReader API. This flaw requires that input be taken from a local file in order to be triggered and cannot be triggered by web content...

openstack-heat: Vulnerability in Heat template validation leading to DoS

A vulnerability was discovered in the OpenStack Orchestration service heat, where a specially formatted template could be used to trick the heat-engine service into opening a local file. Although the file contents are never disclosed to the end user, an OpenStack-authenticated attacker could use...

Design/Logic Flaw

The template-validate command in OpenStack Orchestration API Heat before 2015.1.3 kilo and 5.0.x before 5.0.1 liberty allows remote authenticated users to cause a denial of service memory consumption or determine the existence of local files via the resource type in a template, as demonstrated by...

CVE-2015-5295

The template-validate command in OpenStack Orchestration API Heat before 2015.1.3 kilo and 5.0.x before 5.0.1 liberty allows remote authenticated users to cause a denial of service memory consumption or determine the existence of local files via the resource type in a template, as demonstrated by...