CVE-2017-5182

Remote Manager in Open Enterprise Server OES allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to...

CVE-2017-5480

Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. dot dot in the fmselected array parameter...

PT-2017-16521

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 6.8.4 Description A directory traversal issue exists, allowing remote authenticated users to read or delete arbitrary files. This is achieved by providing a .. dot dot in the fm selected array parameter in the...

PT-2017-7730

Name of the Vulnerable Software and Affected Versions OpenAM - Access Management version 10.1.0 Description The issue allows remote attackers to read arbitrary files via the SAMLRequest parameter in the /SSOPOST/metaAlias/%realm%/idpv2 endpoint. This is an XML External Entity XXE vulnerability...

CVE-2016-7459

VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a 1 Log Browser, 2 Distributed Switch setup, or 3 Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML...

CVE-2015-3271

Apache Tika server aka tika-server in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header...

CVE-2016-9199

A vulnerability in the Cisco application-hosting framework CAF of Cisco IOx could allow an authenticated, remote attacker to read arbitrary files on a targeted system. Affected Products: This vulnerability affects specific releases of the Cisco IOx subsystem of Cisco IOS and IOS XE Software. More...

PT-2016-5344

Name of the Vulnerable Software and Affected Versions IBM FileNet Workplace version 4.0.2 before 4.0.2.14 LA012 Description The issue allows remote authenticated users to read arbitrary files or cause a denial of service due to an XML External Entity XXE issue. This occurs when an XML document...

PT-2016-5336

Name of the Vulnerable Software and Affected Versions IBM AppScan Source versions 8.7 through 9.0.3.3 Description The issue allows remote authenticated users to read arbitrary files or cause a denial of service due to an XML External Entity XXE issue. This occurs when an XML document containing a...

PT-2016-5284

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description A directory traversal issue allows remote authenticated administrators to read arbitrary files by sending a crafted request. Recommendations For versions prior to 9.1.3, update to...

CVE-2016-5765

Administrative Server in Micro Focus Host Access Management and Security Server MSS and Reflection for the Web RWeb and Reflection Security Gateway RSG and Reflection ZFE ZFE allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory...

PT-2017-10097

Name of the Vulnerable Software and Affected Versions Xen affected versions not specified Description The issue allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host. This is achieved through string quotes and S-expressions in the bootloader configuration...

CVE-2016-0284

The XML parser in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Ration...

Spark Directory Traversal Vulnerability

Spark is a set of lightweight framework for creating Web applications. A directory traversal vulnerability exists in Spark version 2.5. A remote attacker can leverage the directory traversal character in the URI '... /' in a URI to read arbitrary files...

PT-2016-6755

Name of the Vulnerable Software and Affected Versions IBM Sterling Secure Proxy SSP versions 3.4.2 through 3.4.2.0 iFix 7 IBM Sterling Secure Proxy SSP versions 3.4.3 through 3.4.3.0 iFix 0 Description A directory traversal issue in the Configuration Manager of IBM Sterling Secure Proxy allows...

CVE-2015-1832

XML external entity XXE vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service resource consumption via vectors involving XmlVTI and the XML dataty...

CVE-2016-5971

IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service memory consumption via an XML document containing an external entity declaration in conjunction with an entity reference,...

PT-2016-6738

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager ISPIM Virtual Appliance versions 2.0.0 through 2.0.2 FP7 Description A directory traversal issue allows remote authenticated users to read arbitrary files by including a .. dot dot in a URL...

CVE-2016-6370

Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment HCM-F 10.63 and earlier allows remote authenticated users to read arbitrary files via a crafted pathname in an HTTP request, aka Bug ID CSCuz27255...

PT-2016-6851

Name of the Vulnerable Software and Affected Versions Cisco Hosted Collaboration Mediation Fulfillment HCM-F versions 10.63 and earlier Description A directory traversal issue exists in the web interface, allowing remote authenticated users to read arbitrary files by crafting a pathname in an HTT...