CVE-2020-7478

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...

CVE-2020-7478

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...

Bosch DIVAR IP 3000 Path Traversal Vulnerability

Bosch DIVAR IP 3000 is a 3000 series video recorder from Bosch Germany. A path traversal vulnerability exists in Bosch DIVAR IP 3000. An unauthenticated, remote attacker could read arbitrary files from a centralized server...

CVE-2019-15983

A vulnerability in the SOAP API of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker would need administrative privileges on the DCNM application...

Microsoft SharePoint Server Information Disclosure Vulnerability (CNVD-2019-46110)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An information...

The vulnerability of the Enterprise Resource Management System “Galaktika ERP” allows a hacker to obtain arbitrary files from the server or overwrite arbitrary files with fixed data.

The vulnerability of the GALAXY ERP resource management system is related to architectural weaknesses in the components .res files that have XML file export functionality. Exploiting this vulnerability allows a malicious actor to read or re-write any file on the server by entering the file path...

Arbitrary File Read Vulnerability in gxlcms Software System

The gxlcms software system is a simple program tailored to the user. An arbitrary file read vulnerability exists in the gxlcms software system. An attacker can exploit this vulnerability to read arbitrary files...

The numerous vulnerabilities in the API interface of the WADashboard component of the Advantech WebAccess software allow a perpetrator to write or overwrite any files in the file system.

The multiple vulnerabilities of the API interface of the WADashboard component in the Advantech WebAccess remote monitoring software are related to deficiencies in path validation before its use in file operations. Exploiting these vulnerabilities could allow a malicious actor to read arbitrary...

CVE-2019-18371

An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. There is a directory traversal vulnerability to read arbitrary files via a misconfigured NGINX alias, as demonstrated by api-third-party/download/extdisks../etc/config/account. With this vulnerability, the attacker can...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the mysql gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS...

CVE-2019-7307

Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users /.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on th...

Path traversal

Path traversal vulnerability in Micro Focus Verastream Host Integrator VHI, versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files...

CVE-2019-1959

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to read arbitrary files on the underlying operating system OS of an affected device. For more information about these vulnerabilities, see the Details section of this adviso...

CVE-2019-1960

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to read arbitrary files on the underlying operating system OS of an affected device. For more information about these vulnerabilities, see the Details section of this adviso...

CVE-2019-1961

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system OS of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the W...

The vulnerability of the Windows Event Viewer component (eventvwr.msc) in the Windows operating system, which allows a malicious individual to read arbitrary files

The vulnerability of the Windows Event Viewer component eventvwr.msc in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability allows an attacker to read arbitrary files using a specially created XML file...

JC6 Collaborative OA platform has xml entity injection vulnerability

JC6 collaborative OA platform is a collaborative office platform based on the J2EE framework. JC6 collaborative OA platform xml entity injection vulnerability, an attacker can use the vulnerability to read arbitrary files...

The vulnerability of the Action View component of the Ruby on Rails software platform, allowing attackers to read arbitrary files

The vulnerability of the Action View component in the Ruby on Rails software framework is related to errors in handling HTTP headers “Accept” when used in the “render file” handler code. Exploiting this vulnerability allows an attacker to read arbitrary files...

CVE-2019-1588

A vulnerability in the Cisco Nexus 9000 Series Fabric Switches running in Application-Centric Infrastructure ACI mode could allow an authenticated, local attacker to read arbitrary files on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms o...

Microsoft Word Information Disclosure Vulnerability

Microsoft Office is an office software suite of products developed by the United States Microsoft Microsoft.Word is a word processing software in the Office suite. An information disclosure vulnerability exists in Microsoft Word, which can be exploited by an attacker to read arbitrary files from...