CVE-2017-8918

XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template.xml file...

Arbitrary Code Execution

doctrine/annotations is vulnerable to arbitrary code execution. The application does not properly enforce file permissions, allowing a malicious user to inject and execute arbitrary local files...

Xxe

XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import...

CVE-2017-9095

CVE-2017-9095 affects Diving Log 6.0 and is an XML External Entity (XXE) vulnerability in the dive.xml import workflow (Subsurface import). An attacker can disclose local files via a crafted dive.xml file. Public exploit references document an XXE payload and steps to exfiltrate data to a remote ...

CVE-2017-12763

An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files...

Code injection

An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files...

CVE-2017-12763

CVE-2017-12763 affects NoMachine before 5.3.10 on macOS and Linux. An authenticated user can escalate privileges by accessing local files via the server utility (nxexec/nxnode.bin) and environment variable spoofing (NX_SYSTEM) to run privileged scripts (e.g., nxcat.sh). Public details include PoC...

CVE-2017-12763

An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files...

Directory traversal

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter to ajax.php...

Synology Download Station Cross-Site Request Forgery Vulnerability

Synology Download Station is a set of web-based download applications from Synology. The program supports BT, FTP and HTTP protocols to download files. A server-side request forgery vulnerability exists in Downloader in Synology Download Station version 3.8.x before 3.8.5-3475 and version 3.x...

CVE-2017-11149

Server-side request forgery SSRF vulnerability in Downloader in Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 allows remote authenticated users to download arbitrary local files via crafted URI...

GNOME applet for NetworkManager: Arbitrary file read/write

Background GNOME applet for NetworkManager is a GTK+ 3 front-end which works under Xorg environments with a systray. Description Frederic Bardy and Quentin Biguenet discovered that GNOME applet for NetworkManager incorrectly checked permissions when connecting to certain wireless networks. Impact...

WordPress plugin "Shortcodes Ultimate" vulnerable to directory traversal

Overview The WordPress plugin "Shortcodes Ultimate" contains a directory traversal vulnerability CWE-22 in the Examples page. Chris Liu reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Arbitrary local files o...

The vulnerability of the WideVine DRM component for the Android operating system allows a violator to gain access to local files.

The vulnerability of the WideVine DRM component for the Android operating system is related to pointer assignment errors. Exploiting this vulnerability could allow a malicious actor to gain access to local files remotely...

The vulnerability of the Android operating system, which allows a hacker to gain access to local files

The vulnerability of the Android operating system is related to pointer arithmetic errors. Exploiting this vulnerability can allow a remote attacker to gain access to local files...

The vulnerability of WideVine DRM on the Android operating system allows a violator to gain access to local files.

The vulnerability of WideVine DRM on the Android operating system is related to pointer swapping errors. Exploiting this vulnerability can allow a malicious actor to gain access to local files remotely...

UBUNTU-CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

KLA11044 Multiple vulnerabilities in Mozilla Firefox and Mozilla Firefox ESR

Multiple serious vulnerabilities have been found in Firefox and Firefox ESR. Malicious users can exploit these vulnerabilities to gain privileges, cause a denial of service, read and write local files, spoof user interface and bypass security restrictions. Below is a complete list of...

CVE-2017-2181

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2182...