SUSE CVE-2014-1297

WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access...

SUSE CVE-2014-5030

CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on 1 index.html, 2 index.class, 3 index.pl, 4 index.php, 5 index.pyc, or 6 index.py...

SUSE CVE-2014-9680

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access but not view file contents by running a program within an sudo session, as demonstrated by interfering with terminal output,...

SUSE CVE-2015-3412

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the streamresolveincludepath function in ext/standard/streamsfuncs.c, as...

SUSE CVE-2015-4176

fs/namespace.c in the Linux kernel before 4.0.2 does not properly support mount connectivity, which allows local users to read arbitrary files by leveraging user-namespace root access for deletion of a file or directory...

SUSE CVE-2016-1242

fileopen in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors...

SUSE CVE-2016-7977

Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document...

SUSE CVE-2017-5182

Remote Manager in Open Enterprise Server OES allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to...

SUSE CVE-2017-17042

lib/yard/coreext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files...

SUSE CVE-2021-29133

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem...

The vulnerability of the Mozilla Firefox browser, related to security configuration errors, allows a hacker to read arbitrary files.

The vulnerability of the Mozilla Firefox browser is related to security configuration errors. Exploiting this vulnerability allows a remote attacker to read arbitrary files...

CVE-2022-45103

Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to read arbitrary files on the underlying file system...

Synology Router Manager 注入漏洞

Synology Router Manager SRM is a software used to configure and manage Synology routers from China-based Synology Inc. An injection vulnerability exists in Synology Router Manager SRM versions prior to 1.2.5-8227-6, 1.3.1-9346-3, which stems from improper neutralization of special elements. An...

CVE-2022-4236

The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server...

PT-2022-5903 · Vmware · Vrealize Log Insight +1

Name of the Vulnerable Software and Affected Versions: vRealize Log Insight affected versions not specified vRealize Network Insight affected versions not specified Description: The issue concerns a Directory Traversal Vulnerability in the vRealize Log Insight and vRealize Network Insight. This...

GMAO LINX LINX Sphere 路径遍历漏洞

GMAO LINX LINX Sphere is a software from GMAO LINX designed for the overall management of industrial and construction grade maintenance departments. A security vulnerability exists in GMAO LINX LINX Sphere version 7.35.ST15, which stems from a directory traversal in the component...

PT-2022-25638

Name of the Vulnerable Software and Affected Versions Apache Airflow Spark Provider versions prior to 4.0.0 Apache Airflow versions prior to 2.3.0 Description The issue is related to an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apach...

GL.iNet GoodCloud 操作系统命令注入漏洞

GL.iNet GoodCloud is an IoT device management system from China's Guanglian Zhitong GL.iNet. An operating system command injection vulnerability exists in GL.iNet GoodCloud version 1.00.220412.00, which stems from the presence of multiple command injection vulnerabilities that allow an attacker t...

PT-2022-6925 · Cisco · Cisco Ise

Name of the Vulnerable Software and Affected Versions: Cisco ISE affected versions not specified Description: A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this...

PT-2022-25227 · Unknown · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal version 2.7 Description: The issue allows authenticated attackers to read arbitrary files in the system due to a path traversal vulnerability. This vulnerability can be exploited via the f parameter at the...