UBUNTU-CVE-2017-16248

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character...

CVE-2012-5358

The XSLTCompiledTransform function in Ektron Content Management System CMS before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or...

The vulnerability of the reportId parameter in the getReportStatus method of the Kaspersky Anti-Virus for Linux File Server antivirus protection tool allows a hacker to access and read arbitrary files.

The vulnerability of the reportId parameter in the getReportStatus method of the Kaspersky Anti-Virus for Linux File Server antivirus tool is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files wit...

WordPress ZipArchive and PclZip Component Directory Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports in PHP and MySQL servers to set up a personal blog site . ZipArchive and PclZip components are among the compression/decompression components . A directory traversal...

Synology Photo Station Directory Traversal Vulnerability (CNVD-2017-27711)

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A directory traversal vulnerability exists in Synology Photo Station versions prior to 6.7.4-3433 and synphotoio versions prior to 6.3-2968. A remote attacker can exploit the vulnerability to...

batik: XML external entity processing vulnerability

An XXE vulnerability was found in Apache Batik which could allow a remote attacker to retrieve the files on the vulnerable server's filesystem by uploading specially crafted SVG images. The vulnerability could also allow a denial of service condition by performing an amplification attack...

Apache Wink XML External Entity Vulnerability

Apache Wink is a U.S. Apache Apache Software Foundation for building RESTful Web services framework , which consists of a server module and the client module for the development of RESTful Web services . An XML external entity injection vulnerability exists in Apache Wink 1.1.1 and earlier...

VulnCheck KEV: CVE-2017-12637

SAP NetWeaver Application Server AS Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. dot dot in the query string...

Directory traversal

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests...

Design/Logic Flaw

'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK...

CVE-2017-9097

In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through 3.30.4, EC250 devices through 1.40.0, and other products, an LFI vulnerability allows a remote attacker to read or modify files through a...

XXE Vulnerability in the ManageMenu.asmx File of MicroXia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. A XXE vulnerability exists in the ManageMenu.asmx file of MicroXia Online Learning Platform, which can be exploited by an attacker to remotely read arbitrary files from the server...

WordPress MDC YouTube Downloader Plugin Directory Traversal Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.MDC YouTube Downloader is one of the video download plugins. A path traversal vulnerability exists in version 2.1.0 of...

XXE Vulnerability in Employee.asmx File of Microxia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. XXE vulnerability exists in the Employee.asmx file of MicroXia Online Learning Platform, which can be exploited by an attacker to remotely read arbitrary files on the server...

XXE Vulnerability in Microxia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. XXE injection vulnerability exists in /Ajax/InResult.ashx, which can be exploited by an attacker to remotely read arbitrary files on the server...

Intellinet NFC-30ir IP Camera Directory Traversal Vulnerability

Intellinet NFC-30ir IP cameras are digital devices based on network transmission. A directory traversal vulnerability in the Intellinet NFC-30ir IP camera in LM.1.6.16.05 allows remote attackers to read arbitrary files via a request to a vendor-supplied CGI script used to read HTML text files...

CVE-2016-4320

Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource...

PYSEC-2017-25

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...

Code injection

The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2017-5583

The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read arbitrary files via unspecified vectors...