CVE-2014-0130

Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files...

PT-2014-4998

Name of the Vulnerable Software and Affected Versions Sixnet SixView Manager version 2.4.1 Description A directory traversal issue allows remote attackers to read arbitrary files by including a .. dot dot in an HTTP GET request to TCP port 18081. Recommendations For Sixnet SixView Manager version...

CVE-2014-0054

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML Extern...

PT-2014-3739

Name of the Vulnerable Software and Affected Versions EMC Cloud Tiering Appliance CTA versions 10 through SP1 Description The issue allows remote attackers to read arbitrary files via an "api/login" request containing an XML external entity declaration in conjunction with an entity reference,...

PT-2014-4510

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection affected versions not specified Description A directory traversal issue exists in the messaging API, allowing remote authenticated users to read arbitrary files. This is related to unenforced access constraints for .wav...

PT-2014-2288

Name of the Vulnerable Software and Affected Versions Zingiri Forum plugin versions prior to 1.4.4 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the zing forum output function. This is achieved by including a .. dot dot in the...

RESTEasy: XML eXternal Entity (XXE) flaw

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding JAXB input, aka an XML external entity XXE injection attack, a similar vulnerability to...

CVE-2014-1297

WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access...

PT-2014-4080

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.1.3 Apple Safari versions 7.x prior to 7.0.3 Description The issue allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access, due to improper...

CVE-2014-1297: Improper Input Validation

WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access...

PT-2014-2482

Name of the Vulnerable Software and Affected Versions MayGion IP Cameras versions prior to 2013.04.22 05.53 Description A directory traversal issue allows remote attackers to read arbitrary files by using a .. dot dot in the default URI. Recommendations For versions prior to 2013.04.22 05.53,...

PT-2014-4797

Name of the Vulnerable Software and Affected Versions McAfee Asset Manager version 6.6 Description A directory traversal issue exists, allowing remote authenticated users to read arbitrary files. This is achieved by using a .. dot dot in the reportFileName parameter of the servlet/downloadReport...

CVE-2014-0002

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...

CVE-2013-2619

Directory traversal vulnerability in Aspen before 0.22 allows remote attackers to read arbitrary files via a .. dot dot to the default URI...

CVE-2014-2324

Multiple directory traversal vulnerabilities in 1 modevhost and 2 modsimplevhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. dot dot in the host name, related to requestcheckhostname...

CVE-2013-4413

Directory traversal vulnerability in controller/concerns/renderredirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F encoded dot dot slash in the step...

PT-2014-2784

Name of the Vulnerable Software and Affected Versions Wicked gem versions prior to 1.0.1 Description The issue allows remote attackers to read arbitrary files via a %2E%2E%2F encoded dot dot slash in the step, due to a directory traversal vulnerability in controller/concerns/render redirect.rb. A...

CVE-2011-3153

dmrc.c in Light Display Manager aka LightDM before 1.1.1 allows local users to read arbitrary files via a symlink attack on /.dmrc...

PT-2014-2702

Name of the Vulnerable Software and Affected Versions Novell ZENworks Configuration Management version 11.2 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in a preboot update pathname. This is a directory traversal vulnerability in the PreBoot service...

PT-2014-3077

Name of the Vulnerable Software and Affected Versions IBM Algo One versions 4.7.0 through 5.0.0 ACSWeb in Algo Security Access Control Management versions 4.7.0 through 4.9.0 ACSWeb in AlgoWebApps version 5.0.0 Description The issue allows remote authenticated users to read arbitrary files via...