Apache Heron Path Traversal Vulnerability

Apache Heron is a distributed , fault-tolerant real-time stream processing engine . A path traversal vulnerability exists in Apache Heron versions 0.13.0 through 0.17.8, which stems from the program failing to adequately filter user-submitted input. A remote attacker could exploit the vulnerabili...

The vulnerability of the Ruby library for handling web resources, Sprockets, related to request processing errors, allows a hacker to gain unauthorized access to information.

The vulnerability of the Ruby library for handling web resources, Sprockets, is related to request processing errors. Exploiting this vulnerability allows an attacker to remotely access files located outside of the application’s root directory and gain unauthorized access to protected information...

The vulnerability of the S3 protocol in the S3 Browser allows a hacker to view files and obtain NTLMv2 user hash values.

The vulnerability of the S3 Browser protocol based on HTTP is related to shortcomings in the restrictions on XML links to external objects. In this case, server responses are transmitted in XML format. Exploiting this vulnerability allows a malicious actor to remotely access files and obtain user...

FreeBSD : kio-extras -- HTML Thumbnailer automatic remote file access (1460aa25-e6ab-11e8-a733-e0d55e2a8bf9)

Albert Astals Cid reports : Various KDE applications share a plugin system to create thumbnails of various file types for displaying in file managers, file dialogs, etc. kio-extras contains a thumbnailer plugin for HTML files. The HTML thumbnailer was incorrectly accessing some content of remote...

GHSA-QV32-7R6P-XHHH Moderate severity vulnerability that affects com.adobe.xmp:xmpcore

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2018-1770

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 148686...

PT-2018-34: XXE Injection in S3 Browser

The specialists of the Positive Research center have detected an XXE Injection vulnerability in S3 Browser. A vulnerability in the HTTP-based S3 protocol, due to server responses transmitted in XML format, allows remote attackers to read user files and obtain NTLMv2 hash values by tricking a user...

JavaMelody XML External Entity Injection Vulnerability

JavaMelody is a set of Java application monitoring tools. The tool is able to monitor Java or Java EE application servers in the QA and actual operation of the production environment , and in the form of graphs to display Java memory and Java CPU usage , the number of users Session , etc...

GHSA-23V3-QFRJ-WMGH Moderate severity vulnerability that affects actionpack

Withdrawn, accidental duplicate publish. Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remo...

CVE-2018-16709

Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-V C5576, DocuCentre-IV C2263, DocuCentre-V C2263, and ApeosPort-V 5070 devices allow remote attackers to read or write to files via crafted PJL commands...

CA Unified Infrastructure Management Lack of Authentication Vulnerability

CA Unified Infrastructure Management is a powerful unified IT monitoring solution that helps organizations deliver reliable, flexible IT services. A lack of authentication vulnerability exists in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, which can be exploited by a remote attack...

HPE CentralView Fraud Risk Management Unauthorized Access Vulnerability

HPE CentralView Fraud Risk Management is an end-to-end solution for solving fraud control problems from Hewlett Packard Enterprise HPE. An unauthorized access vulnerability exists in HPE CentralView Fraud Risk Management CV versions prior to 6.1, which can be exploited by remote attackers to gain...

Sympa Path Traversal Vulnerability

Sympa is an extensible and highly customizable mailing list software. The software provides multiple templates, custom authentication backends and authentication scripts, and support for various mailing list backends LDAP, SQL, text, list or others. A directory traversal vulnerability exists in t...

Dialogic PowerMedia XMS XML External Entity Injection Vulnerability

Dialogic PowerMedia XMS is a highly scalable, software-only media server that supports standards-based, real-time multimedia communication solutions for mobile and broadband environments. An XML external entity injection vulnerability exists in the Web services in Dialogic PowerMedia XMS 3.5 and...

CVE-2018-12631

Redatam7 formerly Redatam WebServer allows remote attackers to read arbitrary files via /redbin/rpwebutilities.exe/text?LFN=../ directory traversal...

Mirasys DVMS Workstation Gateway Path Traversal Vulnerability

Mirasys DVMS Worlstation is a surveillance video management system from the Finnish company Mirasys, of which Gateway is a gateway. A path traversal vulnerability exists in Mirasys DVMS Workstation 5.12.6 and earlier versions of Gateway. A remote attacker can use the Web Client webserver to...

CVE-2017-17309

Huawei HG255s-10 V100R001C163B025SP02 has a path traversal vulnerability due to insufficient validation of the received HTTP requests, a remote attacker may access the local files on the device without authentication...

Code injection

p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100...

The vulnerability of the interpreter for TCL-scenarios of microprogrammed software in the HomeMatic Central Control Unit 2 allows a perpetrator to read and write arbitrary files and execute system commands on the device.

The vulnerability of the TCL interpreter for microprogrammed software in the HomeMatic Central Control Unit 2 relates to deficiencies in security mechanisms. Exploiting this vulnerability allows a malicious actor to remotely read and write arbitrary files and execute system commands on the device...

CVE-2018-10174

Digital Guardian Management Console 7.1.2.0015 has an SSRF issue that allows remote attackers to read arbitrary files via file:// URLs, send TCP traffic to intranet hosts, or obtain an NTLM hash. This can occur even if the logged-in user has a read-only role...