CVE-2018-1079

It was found that the REST interface of the pcsd service did not properly sanitize the file name from the /remote/putfile query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the...

CVE-2018-9109

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...

CVE-2014-3972

Directory traversal vulnerability in Apexis APM-J601-WS cameras with firmware before 17.35.2.49 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2017-12079

Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain arbitrary files via progid field...

UBUNTU-CVE-2017-14949

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities not parameter external entities are properly considered. This is related to XmlRepresentation, DOMRepresentatio...

CVE-2017-14868

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension...

BlackBerry QNX Software Development Platform Elevation of Privilege Vulnerability

The BlackBerry QNX Software Development Platform SDP is a suite of software development platforms from BlackBerry Canada dedicated to the development of software based on the QNX system. An elevation of privilege vulnerability exists in the default configuration of QNX SDP in BlackBerry QNX SDP...

CVE-2017-16248

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character...

Directory traversal

The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference...

CVE-2017-14849

Node.js 8.5.0 before 8.6.0 is vulnerable to directory traversal/file disclosure due to a changed handling of ".." that conflicts with pathname validation in some community modules. The issue allows remote attackers to access unintended files. A fix is available in Node.js 8.6.0 or later. If upgra...

Apps industrial OT over Server: Anti-Web Local File Inclusion(CVE-2017-9097)

Exploit Title: Apps industrial OT over Server: "Anti-Web 3.x.x 3.8.x" vuln: Local File Inclusion Date: 15/05/2017 Exploit Author: Bertin Jose @bertinjoseb && Fernandez Ezequiel @capitanalfa Vendor: Multiples vendors Category: Industrial OT webapps + DESCRIPTION: vulnerability: LFI Local File...

CVE-2017-9095

XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

SAP NetWeaver Application Server Java Directory Traversal Vulnerability (CNVD-2017-29433)

SAP NetWeaver is SAP's integrated service-oriented application platform that provides a development and runtime environment for SAP applications. SAP NetWeaver Application Server AS Java is an application server that runs on NetWeaver and is based on the Java programming language. SAP NetWeaver...

MySQL/MariaDB MantisBT Task File Read Vulnerability

Oracle MySQL is an open source relational database management system from Oracle. A security vulnerability in MantisBT on MySQL/MariaDB allows remote attackers to exploit the vulnerability by submitting a special request to access files on the MantisBT server...

CVE-2017-12637

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657...

CVE-2017-12419

If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory as recommended in the "Post-installation and upgrade tasks" section of the MantisBT Admin Guide, and the MySQL client has a localinfile setting enabled in php.ini...

CVE-2017-12419

CVE-2017-12419 affects MantisBT up to version 2.5.2 installed on MySQL/MariaDB. If the admin leaves the admin directory in place and the MySQL client has local_infile enabled (via php.ini mysqli.allow_local_infile or client config), an attacker can leverage MySQL facial connect-file-read to remot...

CVE-2017-11502

Affected product: Technicolor DPC3928AD DOCSIS devices. Issue: information disclosure via a crafted request starting with GET /../ to TCP port 4321, enabling remote attackers to read arbitrary files. Root cause: directory traversal-like behavior exposed on a dedicated service (port 4321). Impact:...

CVE-2017-9829

'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK...