1532 matches found
PT-2020-1432
Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager DCNM affected versions not specified Description A vulnerability in the SOAP API of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to gain read access to information store...
Microsoft SharePoint Server Information Disclosure Vulnerability (CNVD-2019-46110)
Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An information...
PT-2019-6909
Name of the Vulnerable Software and Affected Versions Loftek Nexus 543 IP Camera affected versions not specified Description The issue allows remote attackers to read arbitrary files by using a .. dot dot in the URL of an HTTP GET request, indicating a directory traversal vulnerability...
The vulnerability of the Enterprise Resource Management System “Galaktika ERP” allows a hacker to obtain arbitrary files from the server or overwrite arbitrary files with fixed data.
The vulnerability of the GALAXY ERP resource management system is related to architectural weaknesses in the components .res files that have XML file export functionality. Exploiting this vulnerability allows a malicious actor to read or re-write any file on the server by entering the file path...
Arbitrary File Read Vulnerability in gxlcms Software System
The gxlcms software system is a simple program tailored to the user. An arbitrary file read vulnerability exists in the gxlcms software system. An attacker can exploit this vulnerability to read arbitrary files...
The numerous vulnerabilities in the API interface of the WADashboard component of the Advantech WebAccess software allow a perpetrator to write or overwrite any files in the file system.
The multiple vulnerabilities of the API interface of the WADashboard component in the Advantech WebAccess remote monitoring software are related to deficiencies in path validation before its use in file operations. Exploiting these vulnerabilities could allow a malicious actor to read arbitrary...
CVE-2019-18371
An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can...
jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.
A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the mysql gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS...
PT-2019-7365
Name of the Vulnerable Software and Affected Versions mTheme-Unus theme versions prior to 2.3 for WordPress Description The issue allows an attacker to read arbitrary files via a .. dot dot in the files parameter to "css/css.php". This is a directory traversal vulnerability. Recommendations For...
CVE-2019-11327: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vulnerability. An attacker with administrative privileges can craft a special URL to read arbitrary files from the device's files system...
CVE-2019-7307
Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users /.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on th...
Path traversal
Path traversal vulnerability in Micro Focus Verastream Host Integrator VHI, versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files...
CVE-2019-1961
A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system OS of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the W...
CVE-2019-1959
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to read arbitrary files on the underlying operating system OS of an affected device. For more information about these vulnerabilities, see the Details section of this adviso...
CVE-2019-1960
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to read arbitrary files on the underlying operating system OS of an affected device. For more information about these vulnerabilities, see the Details section of this adviso...
PT-2019-2646
Name of the Vulnerable Software and Affected Versions Cisco Enterprise NFV Infrastructure Software affected versions not specified Description The issue is related to improper input validation in NFVIS filesystem commands, which could allow a remote attacker with administrator privileges to read ...
The vulnerability of the Windows Event Viewer component (eventvwr.msc) in the Windows operating system, which allows a malicious individual to read arbitrary files
The vulnerability of the Windows Event Viewer component eventvwr.msc in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability allows an attacker to read arbitrary files using a specially created XML file...
CVE-2019-7442: Improper Restriction of XML External Entity Reference
An XML external entity XXE vulnerability in the Password Vault Web Access PVWA of CyberArk Enterprise Password Vault =10.7 allows remote attackers to read arbitrary files or potentially bypass authentication via a crafted DTD in the SAML authentication system...
JC6 Collaborative OA platform has xml entity injection vulnerability
JC6 collaborative OA platform is a collaborative office platform based on the J2EE framework. JC6 collaborative OA platform xml entity injection vulnerability, an attacker can use the vulnerability to read arbitrary files...
