MyBB Directory Traversal Vulnerability

MyBB is a popular web-based very good free forum software developed with PHP and MySQL. A directory traversal vulnerability exists in the backend of MyBB versions prior to 1.8.11, which can be exploited by a remote attacker to submit a special directory traversal request to read arbitrary files...

CVE-2016-6805: Improper Restriction of XML External Entity Reference

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

PT-2017-9020

Name of the Vulnerable Software and Affected Versions Apache Ignite versions prior to 1.9 Description The issue allows man-in-the-middle attackers to read arbitrary files via an XML External Entity XXE vulnerability in modified update-notifier documents. Recommendations For versions prior to 1.9,...

UBUNTU-CVE-2017-0360

fileopen in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242...

Directory traversal

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."...

CVE-2015-8309

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."...

DEBIAN-CVE-2016-10149

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...

CVE-2016-10149

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...

UBUNTU-CVE-2016-10149

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...

PT-2017-17337

Name of the Vulnerable Software and Affected Versions MobaXterm Personal Edition version 9.4 Description A directory traversal issue in the TFTP server allows remote attackers to read arbitrary files by using a .. dot dot in a GET command. Recommendations For MobaXterm Personal Edition version 9....

CVE-2016-7135

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions...

DEBIAN-CVE-2017-5982

Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e encoded dot dot slash in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd...

PT-2017-17011

Name of the Vulnerable Software and Affected Versions Grails PDF Plugin version 0.6 Description The issue allows remote attackers to read arbitrary files via a crafted XML document, exploiting an XML External Entity XXE vulnerability. Recommendations For Grails PDF Plugin version 0.6, update to a...

CVE-2016-4314

Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the logFile parameter to downloadgz-ajaxprocessor.jsp...

CVE-2016-4312

XML external entity XXE vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery SSRF attacks, o...

CVE-2016-4986

Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter...

CVE-2016-4987

Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields...

PT-2017-8638

Name of the Vulnerable Software and Affected Versions Jenkins Image Gallery plugin versions prior to 1.4 Description A directory traversal issue in the Image Gallery plugin allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields. Recommendations...

PT-2017-8637

Name of the Vulnerable Software and Affected Versions Jenkins TAP plugin versions prior to 1.25 Description A directory traversal issue in the TAP plugin allows remote attackers to read arbitrary files via an unspecified parameter. Recommendations For versions prior to 1.25, update the TAP plugin...

CVE-2016-2908: Improper Restriction of XML External Entity Reference

IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity XXE error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service...