CVE-2018-9117

WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application directory via a specially crafted XML request, aka Directory Traversal...

CVE-2018-9116

An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service...

CVE-2018-9116

CVE-2018-9116 is an XXE vulnerability in WireMock prior to 2.16.0. A remote unauthenticated attacker can access local files and internal resources and may cause a Denial of Service by abusing XML External Entity processing. Affected product: WireMock (versions before 2.16.0). Root cause: XML pars...

WireMock XML External Entity Injection Vulnerability

WireMock is an open source HTTP-based API simulator . An XML external entity vulnerability exists in WireMock versions prior to 2.16.0. A remote attacker could exploit this vulnerability to access local files and internal resources and potentially cause a denial of service...

Node.js third-party modules: [angular-http-server] Server Directory Traversal

I would like to report a Server Directory Traversal vulnerability in angular-http-server. It allows reading local files on the target server. Module module name: angular-http-server version: 1.4.3 npm page: https://www.npmjs.com/package/angular-http-server Module Description A very simple...

Mozilla Firefox Content Restriction Bypass Vulnerability

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. A content restriction bypass vulnerability exists in Mozilla Firefox. A remote user can invoke the 'view-source:' URL to bypass content restrictions and view potentially sensitive information i...

undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser

It was found that the AJP connector in undertow does not use the ALLOWENCODEDSLASH option and thus allows the slash and anti-slash characters encoded in a URL. This may lead to path traversal and result in the information disclosure of arbitrary local files...

Design/Logic Flaw

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

DEBIAN-CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

Mail.ru: blind XXE in autodiscover parser

Как воспроизвести: 1 Закинуть на сервер атакующего xml должен быть доступен на сервере атакующего по адресу /autodiscover/autodiscover.xml: Я сделал такой ответ при запросе любой xml'ки: obmhld.com/autodiscover/autodiscover.xml email settings SMTP 52.34.103.214 1191 off [email protected] yandex....

File Inclusion Vulnerability in Apple CMS v8

Apple CMS is a free cms website builder. Apple CMS v8 suffers from a file inclusion vulnerability, which allows an attacker to obtain a webshell by including local arbitrary files to execute a write trojan file...

KLA11198 RLF vulnerability in LibreOffice

A vulnerability was found in LibreOffice. By exploiting this vulnerability malicious users can read local files. This vulnerability can be exploited via WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function. Original advisories LibreOffice Security Advisory Exploitation...

Path traversal

A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files...

CVE-2018-1047

A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files...

CVE-2018-1048

It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOWENCODEDSLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files...

CVE-2018-1047

A path traversal vulnerability was discovered in Undertow's org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method. This could lead to information disclosure of arbitrary local files...

CVE-2018-1048

It was found that the AJP connector in undertow does not use the ALLOWENCODEDSLASH option and thus allows the slash and anti-slash characters encoded in a URL. This may lead to path traversal and result in the information disclosure of arbitrary local files...

UBUNTU-CVE-2018-5107

The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions. The printing process requires files in a specific format so arbitrary data cannot be read but it is possible that some local file information could be exposed. Thi...

CMS Made Simple File Inclusion Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMS Made Simple...