CVE-2017-2180

Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors...

JVN#18739672: WordPress plugin "Booking Calendar" vulnerable to directory traversal

The WordPress plugin "Booking Calendar" provided by wpdevelop contains a directory traversal vulnerability CWE-22. Impact A local file outside of the application on the server may be accessed by a remote attacker. Solution Update the Software Update to the latest version according to the...

Vulnerability of the Windows operating system, allowing a hacker to check files on the disk

The vulnerability of the Microsoft XML service on the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to remotely check files on the disk using a specially crafted web page...

CVE-2017-3846

A vulnerability in the Client Manager Server of Cisco Workload Automation and Cisco Tidal Enterprise Scheduler could allow an unauthenticated, remote attacker to retrieve any file from the Client Manager Server. The vulnerability is due to insufficient input validation. An attacker could exploit...

CVE-2017-5982

Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e encoded dot dot slash in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd...

Hawtio Directory Traversal Vulnerability

hawtio is a Web console for managing Java frameworks . A directory traversal vulnerability exists in hawtio due to the program failing to properly filter user-submitted input. A remote attacker can exploit this vulnerability by using directory traversal characters '... /' to access arbitrary file...

CVE-2016-2087

Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. dot dot in the server name...

UBUNTU-CVE-2016-9565

MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796...

The vulnerabilities of browsers Internet Explorer and Microsoft Edge allow attackers to access the content of local files.

The vulnerability of browsers Internet Explorer and Microsoft Edge is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to access the content of local files remotely...

CVE-2016-9156

A vulnerability in Siemens SICAM PAS all versions before V8.09 could allow a remote attacker to upload, download, or delete files in certain parts of the file system by sending specially crafted packets to port 19235/TCP...

Microsoft Event Viewer 1.0 - XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor: ================= www.microsoft.com Product: ======================== Microsoft Event Viewer Version: 1.0 The Windows Event Viewer shows a log of application and system messages – errors, informatio...

Microsoft Event Viewer 1.0 - XML External Entity Injection

Microsoft Event Viewer 1.0 - XML External Entity Injection + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-EVENT-VIEWER-XXE-FILE-EXFILTRATION.txt + ISR: ApparitionSec + CVE: CVE-2019-0948 Vendor: ===============...

Microsoft Event Viewer 1.0 - XML External Entity Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-EVENT-VIEWER-XXE-FILE-EXFILTRATION.txt + ISR: ApparitionSec + CVE: CVE-2019-0948 Vendor: ================= www.microsoft.com Product: ========================...

SIEMENS SICAM PAS Security Bypass Vulnerability (CNVD-2016-11836)

SICAM PAS is an energy automation solution for the operation of substation equipment. It has open communication interfaces for power system control and control of industrial power supply equipment. A security bypass vulnerability exists in SIEMENS SICAM PAS. A remote attacker can exploit the...

CVE-2016-9177

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. dot dot in the URI...

CVE-2016-7560

The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, which allows remote attackers to read or write to arbitrary files via unspecified vectors...

EUVD-2016-9191

Directory traversal vulnerability in INDAS Web SCADA before 3 allows remote attackers to read arbitrary files via unspecified vectors...

IBM Tivoli Lightweight Infrastructure Directory Traversal Vulnerability

IBM AIX Advanced Interactive eXecutive is a UNIX operating system developed by IBM in the U.S. IBM Tivoli Lightweight Infrastructure also known as LWI is a lightweight architecture. A directory traversal vulnerability exists in Eclipse Help in IBM Tivoli LWI used in IBM AIX versions 5.3, 6.1 and...

Cisco IOS and IOS XE Software Application-Hosting Framework Unauthorized File Access Vulnerability

Cisco IOS and IOS XE Software are operating systems developed by Cisco in the United States for its network devices. An unauthorized file access vulnerability exists in the Application-Hosting Framework component of Cisco IOS and IOS XE Software. When the Iox feature setting is enabled, a remote...

CVE-2016-4264

The Office Open XML OOXML feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity...