CVE-2018-5448

Medtronic 2090 CareLink Programmer’s software deployment network contains a directory traversal vulnerability that could allow an attacker to read files on the system...

Directory traversal

All versions of the Medtronic 2090 Carelink Programmer are affected by a directory traversal vulnerability where the product's software deployment network could allow an attacker to read files on the system...

Xen Arbitrary File Read Vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in X...

Cockpit Server-Side Request Forgery Vulnerability

Cockpit is an open source CMS Content Management System for managing structured content. A server-side request forgery vulnerability exists in Cockpit version 0.13.0. A remote attacker can exploit this vulnerability to read arbitrary files or send TCP traffic to an internal network host with the...

CVE-2018-10201

An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside the root directory of the web server. This vulnerability could be exploited remotely by a crafted URL without credentials, with .../ or ...\ or...

CVE-2017-14611

SSRF Server Side Request Forgery in Cockpit 0.13.0 allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts via the url parameter, related to use of the discontinued aheinze/fetchurlcontents component...

CVE-2018-9010

Intelbras TELEFONE IP TIP200/200 LITE 60.0.75.29 devices allow remote authenticated admins to read arbitrary files via the /cgi-bin/cgiServer.exx page parameter, aka absolute path traversal. In some cases, authentication can be achieved via the admin account with its default admin password...

SquirrelMail Directory Traversal Vulnerability

SquirrelMail is a cross-platform use of PHP4 development Webmail mail system . A directory traversal vulnerability exists in SquirrelMail version 1.4.22. An attacker can exploit this vulnerability to obtain or potentially delete files on the hosting server...

Jubatus Directory Traversal Vulnerability

Jubatus is an online machine learning framework that runs in a distributed environment. A directory traversal vulnerability exists in Jubatus 1.0.2 and earlier versions. A remote person can exploit this vulnerability to read arbitrary files...

CVE-2018-5716

An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by changing a field in the Web Request, can have access to files on the File System of the Server. By specifying a pathname in the POST parameter "lf" to the goform/editlfgetdata UR...

CVE-2016-10710

Biscom Secure File Transfer SFT 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authenticated users to overwrite or read files via crafted requests. Version 5.0.1050 contains the fix...

CVE-2016-10710

Biscom Secure File Transfer SFT 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authenticated users to overwrite or read files via crafted requests. Version 5.0.1050 contains the fix...

Mozilla Firefox Access Privilege Bypass Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in previous versions of Mozilla Firefox 58. An attacker can exploit this vulnerability by performing a symbolic link attack to bypass access privilege protection...

Cisco AnyConnect Profile Editor XML External Entity Injection Vulnerability

Cisco AnyConnect Secure Mobility Client is a secure mobility client from Cisco that provides secure access to networks and applications from any device. the Profile Editor is one of the Profile Document Editors. An XML external entity injection vulnerability exists in the Profile Editor in the...

CVE-2017-17662

Directory traversal in the HTTP server on Yawcam 0.2.6 through 0.6.0 devices allows attackers to read arbitrary files through a sequence of the form '.x./' or '....\x/' where x is a pattern composed of one or more zero or more for the second pattern of either \ or ..\ -- for example a '../',...

CVE-2017-7158

An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Screen Sharing Server" component. It allows attackers to obtain root privileges for reading files by leveraging screen-sharing access...

CVE-2017-10861

Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command...

The vulnerability in the server component of the SAP POS software for accounting automation, trading, and production allows a perpetrator to read, modify, and delete files.

The vulnerability in the server component of the SAP Point of Sale software for accounting, sales, and production automation involves a lack of authentication procedures. Exploiting this vulnerability allows a malicious actor to read, modify, and delete files using port 2200...

QualitySoft QND Directory Traversal Vulnerability

QualitySoft QND is a suite of IT asset management solutions from QualitySoft Japan. The solution features external media control, device operation log viewing and URL filtering. A directory traversal vulnerability exists in QualitySoft QND Advance/Standard. An attacker can exploit this...

MacOS 10.13 root Authentication Bypass (Security Update 2017-001)

The remote host is running a version of MacOS 10.13 or 10.13.1 that is missing a security update. It is, therefore, affected by a root authentication bypass vulnerability. A local attacker or a remote attacker with credentials for a standard user account has the ability to blank out the root...