CVE-2015-1883

IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure...

Oracle E-Business Suite – XXE injection vulnerability

Application: Oracle E-Business Suite Vendor: Oracle Versions Affected: Oracle E-Business Suite 12.1.3, probably others Bugs: XXE injection Reported: 17.07.2015 Vendor response: 24.07.2015 Date of Public Advisory: 19.01.2016 Reference: Oracle CPU Jan 2016 Author: Nikita Kelesis, Ivan Chalykin,...

Microsoft Internet Explorer Information Disclosure Vulnerability (CNVD-2015-04628)

Microsoft Internet Explorer is a popular web browser introduced by Microsoft and bundled with the Windows operating system. An information disclosure vulnerability exists in versions 9 through 11 of Microsoft Internet Explorer, which allows remote attackers to exploit the vulnerability to read...

reading-honda.co.uk XSS vulnerability

Vulnerable URL: http://www.reading-honda.co.uk/interstitial.asp?p=%22%3E%3Cscript%3Ealert%28/XSSPOSED/%29%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 12:11 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

PT-2015-4368

Name of the Vulnerable Software and Affected Versions Slider Revolution revslider plugin versions prior to 4.2 for WordPress Description The issue allows remote attackers to read arbitrary files by exploiting a directory traversal vulnerability in the Slider Revolution plugin. This is achieved by...

CVE-2015-1851

OpenStack Cinder before 2014.1.5 icehouse, 2014.2.x before 2014.2.4 juno, and 2015.1.x before 2015.1.1 kilo allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command...

[SECURITY] [DSA 3292-1] cinder security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3292-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 19, 2015 https://www.debian.org/security/faq -...

CVE-2015-3010

ceph-deploy before 1.5.23 uses weak permissions 644 for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...

CVE-2015-2953

CVE-2015-2953 affects Igreks MilkyStep Light 0.94 and earlier and MilkyStep Professional 1.82 and earlier. The user-information management functionality allows remote attackers to bypass access restrictions and read files via unspecified vectors. This vulnerability is corroborated by CNVD/NVD ent...

Directory traversal

Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to 1 read arbitrary files via a .. dot dot in the fileName parameter to getGfiUpgradeFile or 2 cause a denial of service CPU and memory consumption via a .. dot dot in the fileName parameter to...

IBM Marketing Operations Catalog Traversal Vulnerability

IBM Marketing Operations formerly known as IBM Unica Marketing Operations is a suite of marketing management software from the American company IBM. The software supports streamlining of production processes, tracking of budgets and expenditures, and improved teamwork. A directory traversal...

Adobe Flash Player SWF File Handling Local Information Disclosure Vulnerability

Adobe Flash Player is a cross-platform, browser-based multimedia player product from the American company Adobe. Adobe Flash Player suffers from an information disclosure vulnerability in the handling of swf files, which can be exploited by remote attackers to construct malicious content and tric...

CVE-2015-0758

Cisco Unified MeetingPlace 8.6(1.9) is affected by CVE-2015-0758 via an XML External Entity (XXE) processing flaw that allows authenticated, remote attackers to read arbitrary files from the server. The vulnerability stems from improper handling of XML entities in the web-based user interface, as...

CVE-2015-3995

SAP HANA DB 1.00.73.00.389160 NewDB100REL allows remote authenticated users to read arbitrary files via an IMPORT FROM SQL statement, aka SAP Security Note 2109565...

DEBIAN-CVE-2015-1833

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...

CVE-2015-2121

CVE-2015-2121 affects HP Network Virtualization for LoadRunner and Performance Center (versions 11.52 and 8.61). The root cause is failure to sanitize filenames in URLs handled by HttpServlet and NetworkEditorController, allowing remote attackers to read arbitrary files. This information-disclosu...

CVE-2015-1907

The Administration and Reporting Tool in IBM Rational License Key Server RLKS 8.1.4 before 8.1.4.7 allows remote authenticated users to read cookies via unspecified vectors...

CVE-2015-1155

The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site...

The vulnerability of Google Chrome browser allows a malicious actor to trigger a service denial.

The vulnerability in the Blink browser of Google Chrome, whose exploitation could allow a remote attacker to cause a service failure reading beyond the boundaries...

Citrix XenServer Multiple Vulnerabilities (CTX200892)

The version of Citrix XenServer installed on the remote host is affected by multiple vulnerabilities : - A flaw exists in the VGA emulator in QEMU that allows a local guest user to read host memory by setting the display to a high resolution. CVE-2014-3615 - A flaw exists in the setpixelformat...