1530 matches found
PT-2015-6582
Name of the Vulnerable Software and Affected Versions SE HTML5 Album Audio Player plugin versions 1.1.0 and earlier Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the file parameter of the download audio.php file. This is a directory traversal...
PT-2015-4052
Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla! Description A directory traversal issue exists, allowing remote administrators to read arbitrary files. This is achieved by using a .. dot dot in the file...
PT-2015-6040
Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to read arbitrary files or cause a denial of service due to directory traversal vulnerabilities. This can be achieved by using a .. dot dot in the fileName...
CVE-2015-0112: Undefined Security Weakness
Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.0.1, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Quality Manager RQM 2.0 through 2.0.1, 3.0 through 3.0.1.6, 4.0 through 4.0.7, and 5.0 through 5.0.2; Rational Team Concert RTC 2.0 through...
CVE-2015-0263
XML external entity XXE vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource...
CVE-2015-0264: Undefined Security Weakness
Multiple XML external entity XXE vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML 1 String or 2 GenericFile object in an XPath query...
CVE-2015-1493
Directory traversal vulnerability in the mingetslashargument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter, as demonstrated ...
CVE-2015-0758: Exposure of Sensitive Information to an Unauthorized Actor
The web-based user interface in Cisco Unified MeetingPlace 8.61.9 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCus97452...
CVE-2015-1833
XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...
PT-2015-5346
Name of the Vulnerable Software and Affected Versions Aruba Networks ClearPass Policy Manager versions prior to 6.4.4 Description A directory traversal issue allows remote administrators to read arbitrary files. Recommendations For versions prior to 6.4.4, update to version 6.4.4 or later to...
CVE-2014-8924: Undefined Security Weakness
The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity...
PT-2015-5723
Name of the Vulnerable Software and Affected Versions Huawei SEQ Analyst versions prior to V200R002C03LG0001CP0022 Description The issue allows remote authenticated users to read arbitrary files. This is achieved via the req parameter, which is vulnerable to XML external entity XXE attacks...
CVE-2015-3301: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...
PT-2015-5137
Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.2.6 Apple Safari versions 7.x prior to 7.1.6 Apple Safari versions 8.x prior to 8.0.6 Description The issue allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web...
Elastic Elasticsearch < 1.4.5, 1.5.x < 1.5.2 Directory Traversal Vulnerability - Active Check
Elastic Elasticsearch is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2015-1322
Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu vivid before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a...
PT-2015-3934
Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions prior to 11.9 build 11912 OpManager versions 8 through 11.5 build 11400 IT360 versions 10.5 and earlier Description The issue allows remote attackers and remote authenticated users to read arbitrary...
USN-2581-1 network-manager vulnerability
Tavis Ormandy discovered that NetworkManager incorrectly filtered paths when requested to read modem device contexts. A local attacker could possibly use this issue to bypass privileges and manipulate modem device configuration or read arbitrary files...