PT-2015-4962

Name of the Vulnerable Software and Affected Versions TAGAWA Takao TransmitMail versions 1.0.11 through 1.5.8 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability related to attachment handling. Recommendations For versions 1.0.11 throug...

CVE-2014-8125

XML external entity XXE vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file...

PT-2015-3799

Name of the Vulnerable Software and Affected Versions New Atlanta BlueDragon versions prior to 7.1.1.18527 Description The issue allows remote attackers to potentially read or delete arbitrary files due to a directory traversal vulnerability in the CFChart servlet. This is achieved by including a...

PT-2015-5071

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.3 Description A directory traversal issue exists, allowing attackers to read arbitrary files by providing a crafted relative path. Recommendations For versions prior to 8.3, update to version 8.3 or later to resol...

VulnCheck KEV: CVE-2015-0666

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager DCNM allows remote attackers to read arbitrary files...

PT-2015-4170

Name of the Vulnerable Software and Affected Versions Codoforum version 2.5.1 Description The issue concerns the sanitize function, which does not properly filter directory traversal sequences. This allows remote attackers to read arbitrary files by including a .. dot dot in the path parameter to...

CVE-2015-0271

The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard horizon allows remote attackers to read arbitrary files via a crafted path...

GNU patch local directory traversal vulnerability

A GNU patch is a part of the GNU project that is the base patch to be installed when installing a theme package. A local directory traversal vulnerability exists in GNU patch that stems from the program failing to adequately filter user-submitted input. A local attacker could use this vulnerabili...

cups: insufficient checking leads to privilege escalation

It was discovered that CUPS allowed certain users to create symbolic links in certain directories under /var/cache/cups/. A local user with the 'lp' group privileges could use this flaw to read the contents of arbitrary files on the system or, potentially, escalate their privileges on the system...

PT-2015-4981

Name of the Vulnerable Software and Affected Versions ShareLaTeX versions 0.1.3 and earlier Description The issue allows remote authenticated users to read arbitrary files via a include command due to an absolute path traversal vulnerability when the paranoid openin any setting is omitted...

CVE-2015-2071

Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote authenticated users to read arbitrary files via a .. dot dot in the filepath parameter...

PT-2015-5584

Name of the Vulnerable Software and Affected Versions eTouch SamePage Enterprise Edition version 4.4.0.0.239 Description A directory traversal issue exists, allowing remote authenticated users to read arbitrary files. This is achieved by using a .. dot dot in the filepath parameter of the...

PT-2015-4891

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 36.0 Firefox ESR versions prior to 31.5 Thunderbird versions prior to 31.5 Description The issue allows remote attackers to read arbitrary files via crafted JavaScript code, leveraging the Form Autocompletion...

PT-2017-6356

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.24.1 MediaWiki versions prior to 1.23.8 MediaWiki versions prior to 1.22.15 MediaWiki versions prior to 1.19.23 Description The issue allows remote attackers to read arbitrary files, cause a denial of service, or...

CVE-2014-3682

XML external entity XXE vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file...

PT-2015-3732

Name of the Vulnerable Software and Affected Versions jbpm-designer versions 6.0.x through 6.2.x Description The issue allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file, due to an XML external entity XXE vulnerability in t...

CVE-2014-3682: Undefined Security Weakness

XML external entity XXE vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file...

CVE-2014-3578

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL...

CVE-2014-6194: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in an unspecified web form in IBM Maximo Asset Management 7.1 through 7.1.1.13 and 7.5.0 before 7.5.0.6 IFIX007, Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk, and Maximo Asset Management 7.1 through 7.1.1.13...

PT-2015-3833

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.1 through 7.1.1.13 IBM Maximo Asset Management versions 7.5.0 through 7.5.0.3 IBM Maximo Asset Management versions 7.5.0 before 7.5.0.6 IFIX007 IBM Maximo Asset Management versions 7.5.1 through 7.5.1.2 f...