Netgear Management System NMS300 Directory Traversal Vulnerability

The Netgear Management System NMS300 is a network management system for diagnosing, controlling and optimizing network devices. A directory traversal vulnerability in the Netgear Management System NMS300's handling of the 'realName' parameter allows remote attackers to obtain arbitrary system fil...

Directory traversal vulnerability in guard-livereload

The vulnerability allows remote attackers to read arbitrary files on the server by exploiting improper path validation in the livereload server functionality. This vulnerability is related to the handling of file paths in the livereload server component, which could allow an attacker to traverse...

CVE-2016-1505

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore...

CVE-2015-8747

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name...

jenkins: Local file inclusion vulnerability (SECURITY-195)

Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/...

CVE-2016-1897

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...

CVE-2016-1898

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains an arbitrary line of a local file...

EasyCafe Server Remote File Access

This module exploits a file retrieval vulnerability in EasyCafe Server. The vulnerability can be triggered by sending a specially crafted packet opcode 0x43 to the 831/TCP port. This module has been successfully tested on EasyCafe Server version 2.2.14 Trial mode and Demo mode on Windows XP SP3 a...

The vulnerability of the microprogramming software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems allows a intruder to read or write files.

The vulnerability of the FTP service provided by the microprogramming software for Janitza UMG 508, 509, 511, 604, and 605 control systems is related to the use of a default password. Exploiting this vulnerability allows an attacker to remotely read or write files by establishing a TCP session on...

CVE-2015-4963

IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via unspecified vectors...

CVE-2015-6003

Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X 1 user or 2 guest account...

CVE-2015-7602

CVE-2015-7602 : Concrete details from connected docs show a directory traversal vulnerability in BisonWare BisonFTP Server v3.5. A remote attacker can read arbitrary files by sending a RETR command including traversal sequences (e.g., ../) to the FTP service. The vulnerability affects BisonFTP Se...

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise Absolute Path Traversal Vulnerability

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric Company GE, U.S.A. GE Digital Energy MDS PulseNET is a suite of software applications for monitoring and controlling industrial communication network devices. Enterprise is an enterprise version of MD...

H2O vulnerable to directory traversal

Overview H2O is an open source web server software. H2O contains an issue in processing URL, which may result in a directory traversal CWE-22 vulnerability. Yusuke OSUMI reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

Directory traversal

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the PATHINFO to the default URI...

GNU troff contrib/pdfmark/pdfroff.sh design error vulnerability

Groff GNU Troff is the latest open source implementation of Troff, a document preparation system that generates print and screen documents from the same input source for a variety of devices. GNU troff groff versions prior to 1.21 in contrib/pdfmark/pdfroff.sh starts the Ghostscript program witho...

CVE-2015-4495

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the...

Camel: XXE in via SAXSource expansion

It was found that Apache Camel's XML converter performed XML External Entity XXE expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

osCommerce Japanese Directory Traversal Vulnerability

osCommerce Japanese is a GNUGPL license based on the Japanese version of the open source online shopping e-commerce solution . A directory traversal vulnerability exists in osCommerce Japanese 2.2ms1j-R8 and earlier versions. A remote attacker can exploit this vulnerability to read arbitrary file...

CVE-2015-5068

XML external entity XXE vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security Note 2159601...