1530 matches found
PT-2014-2485
Name of the Vulnerable Software and Affected Versions QuiXplorer versions prior to 2.5.5 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the zip download functionality. This is achieved by using a .. dot dot in the selitems...
PT-2014-7145
Name of the Vulnerable Software and Affected Versions OSClass versions prior to 3.4.2 Description The issue allows remote attackers to read arbitrary files by exploiting a directory traversal vulnerability. This is achieved by including a .. dot dot in the file parameter within a render action to...
CVE-2014-3664
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors...
CVE-2014-3664: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors...
jenkins: directory traversal flaw (SECURITY-131)
Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors...
PT-2014-6448
Name of the Vulnerable Software and Affected Versions JobScheduler versions prior to 1.6.4246 JobScheduler versions 7.x prior to 1.7.4241 Description The issue allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external...
PT-2014-5842
Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8 Description The issue allows attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue in the...
CVE-2014-5393: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the JobScheduler Operations Center JOC in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241 allows remote authenticated users with the info permission to read arbitrary files in the webroot via unspecified vectors...
PT-2014-6260
Name of the Vulnerable Software and Affected Versions OpenDaylight version 1.0 Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference in an XML-RPC message, related to an XML External Entity XXE issue...
CVE-2014-3490
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...
CVE-2014-1222: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party...
PT-2014-4021
Name of the Vulnerable Software and Affected Versions Vtiger CRM versions prior to 6.0.0 Security patch 1 Description A directory traversal issue allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter in a download action. This issue is likely in the...
PT-2014-5556
Name of the Vulnerable Software and Affected Versions Pyplate version 0.08 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by including a .. dot dot in the filename parameter of the download.py module. Recommendations For Pyplate version 0.08,...
PT-2014-5356
Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform EAP version 6.3.0 RESTEasy versions 2.3.1 through 2.3.8.SP2 RESTEasy versions 3.x through 3.0.9 Description The issue is related to an XML External Entity XXE problem, where external entities are n...
CVE-2013-5757
Yealink VoIP Phone SIP-T38G is affected by CVE-2013-5757 (absolute path traversal) via the cgiServer.exx command parameter (dumpConfigFile). The vulnerability allows remote authenticated users to read arbitrary files by supplying a full pathname, with corroborating references describing /etc/pass...
PT-2014-2952
Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G version affected versions not specified Description The issue concerns an absolute path traversal vulnerability. It allows remote authenticated users to read arbitrary files by providing a full pathname in the...
PT-2014-2951
Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G version affected versions not specified Description A directory traversal issue allows remote authenticated users to read arbitrary files by using a .. dot dot in the page parameter to the "cgi-bin/cgiServer.exx"...
PT-2014-1768
Name of the Vulnerable Software and Affected Versions CUPS version 1.7.4 Description The issue allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ by setting the language0 variable to null. This is due to an incomplete fix for a previo...
CVE-2014-3323: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262...
