UBUNTU-CVE-2017-5084

Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...

CVE-2017-5084

Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...

CVE-2017-5084

Removed by vendor...

PT-2017-16292

Name of the Vulnerable Software and Affected Versions Google Chrome OS versions prior to 59.0.3071.92 Description The issue is related to an inappropriate implementation in the image-burner component. A local attacker could potentially read local files by sending dbus-send commands to a BurnImage...

CVE-2017-12629

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...

CVE-2017-12629

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML extern...

Marp vulnerable to improper access control in JavaScript execution

Overview Marp is a tool to create a presentation PDF with Markdown. Marp executes JavaScript inside the Markdown contents. Marp allows JavaScript to access local resources and files CWE-284. Keitaro Yamazaki of Kyoto University reported this vulnerability to IPA. JPCERT/CC coordinated with the...

Mozilla Firefox File Read Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 56. The vulnerability can be exploited by remote attackers to open locally stored files with the help of malicious web...

Zomato: SSRF in https://www.zomato.com████ allows reading local files and website source code

@nbsp found a SSRF vulnerability which leads to read local files from the web server source code & system files. We have resolved the issue quickly and rewarded the researcher...

Apache HTTP Server mod_ssl Local File Access

The vulnerability of the modssl module in the Apache HTTP Server is related to NULL pointer dereferencing errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to local files by calling the external module function aphookprocessconnection during an HTTPS...

CVE-2017-8918

XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template.xml file...

PT-2017-18622

Name of the Vulnerable Software and Affected Versions Blackwave Dive Assistant - Desktop Edition version 8.0 Description The issue allows attackers to remotely view local files by using a crafted template.xml file, exploiting an XXE XML External Entity vulnerability in the Template Builder...

Arbitrary Code Execution

doctrine/annotations is vulnerable to arbitrary code execution. The application does not properly enforce file permissions, allowing a malicious user to inject and execute arbitrary local files...

Xxe

XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import...

CVE-2017-9095

CVE-2017-9095 affects Diving Log 6.0 and is an XML External Entity (XXE) vulnerability in the dive.xml import workflow (Subsurface import). An attacker can disclose local files via a crafted dive.xml file. Public exploit references document an XXE payload and steps to exfiltrate data to a remote ...

CVE-2017-12763

An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files...

Code injection

An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files...

CVE-2017-12763

An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files...

CVE-2017-12763

CVE-2017-12763 affects NoMachine before 5.3.10 on macOS and Linux. An authenticated user can escalate privileges by accessing local files via the server utility (nxexec/nxnode.bin) and environment variable spoofing (NX_SYSTEM) to run privileged scripts (e.g., nxcat.sh). Public details include PoC...

CVE-2017-12763: Incorrect Default Permissions

An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files...