CVE-2018-6179

Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension...

UBUNTU-CVE-2018-6179

Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension...

Linux: Check options for /home directory

The /home directory contains local files for user. This script tests options set on /home filesystem. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Publi...

CVE-2018-17247

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

CVE-2018-17247

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

Directory Traversal

cordova-plugin-ionic-webview is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of protection on OS local files, allowing third party applications to access local files through cordova-plugin-ionic-webview...

Path Traversal

Overview Versions of cordova-plugin-ionic-webview prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications. The package launches a webserver listening on http://localhost:8080 without restricting access of...

Information Disclosure

phpmyadmin is vulnerable to information disclosure. An attacker with access to the login system and configuration storage tables is able to retrieve local files due to an error in the transformation feature...

chromium-browser: Inappropriate implementation in Extensions

Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension...

chromium-browser: Insufficient policy enforcement in Blink

Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension...

CVE-2018-6095

Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page...

CVE-2018-6095

Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page...

CVE-2018-6095

Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page...

UBUNTU-CVE-2018-6095

Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page...

Local File Inclusion (LFI)

athlon1600/php-proxy-app is vulnerable to local file inclusion LFI attacks. The vulnerability exists due to the ability to include file:/// in the value of q, which allows unauthenticated users to read local files...

PHP-Proxy 5.1.0 - Local File Inclusion

PHP-Proxy 5.1.0 - Local File Inclusion Exploit Title: PHP-Proxy 5.1.0 - Local File Inclusion Date: 2018-11-13 Exploit Author: Ameer Pornillos Contact: https://ethicalhackers.club Vendor Homepage: https://www.php-proxy.com/ Software Link: https://www.php-proxy.com/download/php-proxy.zip Version:...

PHP-Proxy 5.1.0 Local File Inclusion

Exploit Title: PHP-Proxy 5.1.0 - Local File Inclusion Date: 2018-11-13 Exploit Author: Ameer Pornillos Contact: https://ethicalhackers.club Vendor Homepage: https://www.php-proxy.com/ Software Link: https://www.php-proxy.com/download/php-proxy.zip Version: 5.1.0 Category: Webapps Tested on: XAMPP...

Authorization

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" intended for users who lack shell access to their web server is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 appkey value from the default config.php is in place, and this value ca...

CVE-2018-19246

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" intended for users who lack shell access to their web server is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 appkey value from the default config.php is in place, and this value ca...

Mozilla Firefox ESR < 60.3 Multiple Vulnerabilities (macOS)

The version of Mozilla Firefox ESR installed on the remote macOS host is prior to 60.3. It is, therefore, affected by multiple vulnerabilities : - During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the...