SAP NetWeaver AS JAVA XML External Entity Injection Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform, the platform can provide the development and operation environment for SAP applications. SAP NetWeaver AS Application Server Java is a run in NetWeaver and based on the Java programming language...

EMC Data Protection 'input' Parameter Directory Traversal Vulnerability

EMC Data Protection Advisor is a data protection management solution from EMC Corporation. The solution supports automated and centralized execution of all such data collection and analysis, as well as obtaining a single comprehensive view of the data protection environment and activities. A...

Foscam C1 Indoor HD Camera Path Traversal Vulnerability

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A path traversal vulnerability exists in the web management interface in the Foscam C1 Indoor HD Camera using application firmware version 2.52.2.37. An attacker can exploit the vulnerability by sending an HTTP request to th...

CVE-2017-2829

An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause the application to read a file from disk but a failure to adequately filter characters...

CVE-2017-6681

A vulnerability in the AutoVNF VNFStagingView class of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to execute a relative path traversal attack, enabling an attacker to read sensitive files on the system. More Information: CSCvc76662. Known Affected Releases:...

CVE-2017-2308

An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device...

Red Hat JBoss Enterprise Application Platform Cross-Site Scripting Vulnerability

Red Hat JBoss Enterprise Application Platform EAP is the United States Red Hat Red Hat company's set of open source, J2EE-based middleware platform. The platform is mainly used to build, deploy and host Java applications and services. Red Hat JBoss EAP 7.0.5 version of the...

CVE-2017-9024

Secure Bytes Cisco Configuration Manager, as bundled in Secure Bytes Secure Cisco Auditor SCA 3.0, has a Directory Traversal issue in its TFTP Server, allowing attackers to read arbitrary files via ../ sequences in a pathname...

DEBIAN-CVE-2017-9079

Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorizedkeys file format with a command= option. This occurs because /.ssh/authorizedkeys is read with root privileges and symlinks are followed...

CVE-2017-9030

The Codextrous B2J Contact aka b2jcontact extension before 2.1.13 for Joomla! allows a directory traversal attack that bypasses a uniqid protection mechanism, and makes it easier to read arbitrary uploaded files...

Synology Photo Station Directory Traversal Vulnerability (CNVD-2017-06921)

Synology Photo Station is a solution for sharing pictures, videos and blogs over the Internet from Synology, a Chinese company. A directory traversal vulnerability exists in the download.php file in Synology Photo Station versions prior to 6.5.3-3226. A remote attacker can exploit the vulnerabili...

simple-file-manager Path Traversal Vulnerability

simple-file-manager is a web-based file management utility. A path traversal vulnerability exists in versions of simple-file-manager prior to 2017-04-26. An attacker could use this vulnerability to read files...

SolarWinds Log and Event Manager Information Disclosure Vulnerability

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. An information disclosure vulnerability exists in SolarWinds Log and Event Manager 6.3.1, which can be exploited by a local attacker to log in to...

Atlassian JIRA Remote Code Execution Vulnerability

Atlassian JIRA is a project and transaction tracking tool from Atlassian. The Atlassian JIRA Workflow Designer plug-in does not properly use XML parsers and parallelizers, which can be exploited by remote attackers to submit special serialized Java objects, execute arbitrary code, read arbitrary...

CVE-2017-7461

Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows remote attackers to read arbitrary files via a request to a vendor-supplied CGI script that is used to read HTML text file, but that does not do any URI/path...

Wonder CMS Path Traversal Vulnerability

Wonder CMS is an open source content management system CMS. A directory traversal vulnerability exists in the index.php file in Wonder CMS version 2014. A remote attacker can exploit this vulnerability to read arbitrary files with the help of a specially crafted theme...

CVE-2016-8017

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows authenticated remote attackers to read files on the webserver via a crafted user input...

CVE-2017-6344

XML External Entity XXE vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document...

CVE-2016-4312

XML external entity XXE vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery SSRF attacks, o...

pdfbox: XML External Entity vulnerability

It was found that the parsing of XMP and other XML formats in PDF by Apache PDFBox would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks...