Synology Download Station Cross-Site Request Forgery Vulnerability

Synology Download Station is a set of web-based download applications from Synology. The program supports BT, FTP and HTTP protocols to download files. A server-side request forgery vulnerability exists in Downloader in Synology Download Station version 3.8.x before 3.8.5-3475 and version 3.x...

CVE-2017-11149

Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...

GNOME applet for NetworkManager: Arbitrary file read/write

Background GNOME applet for NetworkManager is a GTK+ 3 front-end which works under Xorg environments with a systray. Description Frederic Bardy and Quentin Biguenet discovered that GNOME applet for NetworkManager incorrectly checked permissions when connecting to certain wireless networks. Impact...

PT-2017-15287

Name of the Vulnerable Software and Affected Versions Marp versions v0.0.10 and earlier Description The issue may allow an attacker to access local resources and files using JavaScript. Recommendations For Marp versions v0.0.10 and earlier, update to a version later than v0.0.10 to resolve the...

WordPress plugin "Shortcodes Ultimate" vulnerable to directory traversal

Overview The WordPress plugin "Shortcodes Ultimate" contains a directory traversal vulnerability CWE-22 in the Examples page. Chris Liu reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Arbitrary local files o...

Android Local File Access

The vulnerability of the Android operating system is related to pointer arithmetic errors. Exploiting this vulnerability can allow a remote attacker to gain access to local files...

WideVine DRM Local File Access

The vulnerability of WideVine DRM on the Android operating system is related to pointer swapping errors. Exploiting this vulnerability can allow a malicious actor to gain access to local files remotely...

WideVine DRM Local File Access

The vulnerability of the WideVine DRM component for the Android operating system is related to pointer assignment errors. Exploiting this vulnerability could allow a malicious actor to gain access to local files remotely...

UBUNTU-CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

PT-2017-2298

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A pointer dereference issue exists in the WideVine DRM component of the Android operating system. This issue can be exploited by a remote attacker to gain access to local files. Recommendatio...

PT-2017-2289

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A pointer dereference issue exists in the WideVine DRM component of the Android operating system. This issue can potentially allow a remote attacker to access local files. Recommendations At...

KLA11044 Multiple vulnerabilities in Mozilla Firefox and Mozilla Firefox ESR

Multiple serious vulnerabilities have been found in Firefox and Firefox ESR. Malicious users can exploit these vulnerabilities to gain privileges, cause a denial of service, read and write local files, spoof user interface and bypass security restrictions. Below is a complete list of...

CVE-2017-2181

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2182...

Design/Logic Flaw

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2181...

Design/Logic Flaw

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors...

Design/Logic Flaw

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2182...

CVE-2017-2182

CVE-2017-2182 affects the Hands-on Vulnerability Learning Tool “AppGoat” Web Application (V3.0.2 and earlier). The issue allows remote attackers to obtain local files via unspecified vectors; the core details, affected component (AppGoat Web app), and impact are stated in public records, with no ...

CVE-2017-2180

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors...

CVE-2017-2181

CVE-2017-2181 affects the Hands-on Vulnerability Learning Tool “AppGoat” Web Application, versions 3.0.2 and earlier. The provided documents state a vulnerability that allows remote attackers to obtain local files via unspecified vectors. The root cause, exact exploit path, affected components, a...