CVE-2018-20298

S3 Browser before 8.1.5 contains an XML external entity XXE vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol...

PT-2018-14764

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 4.6.5 Grafana versions 5.x prior to 5.3.3 Description The issue allows remote authenticated users with Editor or Admin permissions to read arbitrary files. Recommendations For versions prior to 4.6.5, update to versio...

UBUNTU-CVE-2018-16872

A flaw was found in qemu Media Transfer Protocol MTP. The code opening files in usbmtpgetobject and usbmtpgetpartialobject and directories in usbmtpobjectreaddir doesn't consider that the underlying filesystem may have changed since the time lstat2 was called in usbmtpobjectalloc, a classical...

SDCMS Directory Traversal Vulnerability

SDCMS is a PHP and MySQL based enterprise station building content management system CMS from China Fireworks Network Technology Company. A directory traversal vulnerability exists in the app/plug/attachment/controller/admincontroller.php page in SDCMS version 1.6. The vulnerability can be...

glusterfs: Heap-based buffer overflow via "gf_getspec_req" RPC message

A buffer overflow on the heap was found in gfgetspecreq RPC request. A remote, authenticated attacker could use this flaw to cause denial of service and read arbitrary files on glusterfs server node...

glusterfs: Heap-based buffer overflow via "gf_getspec_req" RPC message

A buffer overflow on the heap was found in gfgetspecreq RPC request. A remote, authenticated attacker could use this flaw to cause denial of service and read arbitrary files on glusterfs server node...

CVE-2018-10822

Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices allows remote attackers to read arbitrary...

Moderate severity vulnerability that affects org.apache.ignite:ignite-core

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents...

CVE-2013-7203

gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup...

LG SuperSign EZ CMS 2.5 - Local File Inclusion Vulnerability

Exploit for hardware platform in category web applications Exploit Title: LG SuperSign EZ CMS 2.5 - Local File Inclusion Exploit Author: Alejandro Fanjul Vendor Homepage: https://www.lg.com/ar/software-lg-supersign Version: SuperSign EZ CMS Tested on: Web OS 4.0 CVE : CVE-2018-16288 More info:...

Dell EMC Unity Authentication Bypass Vulnerability

Dell EMC Unity is a fully unified storage array designed for flash storage. An authentication bypass vulnerability exists in Dell EMC Unity, which can be exploited by a remotely authenticated user to interact directly with certain APIs of the Unity OE to read files in a NAS server, thereby...

HScripts PHP File Browser Script Path Traversal Vulnerability

HScripts PHP File Browser Script is a file browser script that is used to display, search and browse folders. A directory traversal vulnerability exists in the index.php file in version 1.0 of HScripts PHP File Browser Script. The vulnerability can be exploited to read all files with known names...

Microsoft Windows Local Elevation of Privilege Vulnerability (CNVD-2018-21200)

Microsoft Windows is a set of operating systems developed by Microsoft Corporation in the United States. Microsoft Windows suffers from a local elevation of privilege vulnerability. Any file read by an attacker exploiting this vulnerability is accessed as a user and the system has write DACL...

PHPOK 4.9.015 has an arbitrary file read vulnerability

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. PHPOK version 4.9.015 contains an arbitrary file read vulnerability that can be exploited by attackers to read arbitrary files...

Dell EMC Data Protection Advisor XML External Entity Vulnerability

Dell EMC Data Protection Advisor is a data protection management solution from Dell, Inc. The solution supports automated and centralized execution of all such data collection and analysis, as well as obtaining a single comprehensive view of the data protection environment and activities. An XML...

CVE-2018-0617

Directory traversal vulnerability in ChamaNet MemoCGI v2.1800 to v2.2200 allows remote attackers to read arbitrary files via unspecified vectors...

GHSA-4RVG-955W-H68Q Path Traversal in angular-http-server

Affected versions of angular-http-server are vulnerable to path traversal allowing a remote attacker to read files from the server that uses angular-http-server. Recommendation Update to version 1.6.0 or later. :exclamation: Note: This was originally thought to be fixed in version 1.4.3, though...

CVE-2017-3209

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem...

PT-2018-16184 · Buttle · Buttle

Name of the Vulnerable Software and Affected Versions: buttle versions = 0.2.0 Description: The issue concerns a path traversal vulnerability in the buttle module, allowing attackers to read any file on the server due to insufficient input sanitization. This can be exploited by using relative pat...

Path traversal Vulnerability in the review attachment resource - CVE-2017-16859

The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command...