Design/Logic Flaw

Cisco FireSIGHT Management Center with software 4.10.3, 5.2.0, 5.3.0, 5.3.1, and 5.4.0 allows remote authenticated users to read arbitrary files via a crafted GET request, aka Bug ID CSCur25410...

Camel: XXE in via SAXSource expansion

It was found that Apache Camel's XML converter performed XML External Entity XXE expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more...

Microsoft .NET Framework Directory Traversal Vulnerability

Microsoft .NET Framework is a popular software development toolkit. A directory traversal vulnerability in Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2,4.6 allows remote attackers to read arbitrary files by combining entity references with external entity declaratio...

CVE-2015-6096

The XML DTD parser in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka ".NET Information Disclosu...

CVE-2015-5671

Techno Project Japan Enisys Gw before 1.4.1 allows remote attackers to bypass intended access restrictions and read arbitrary uploaded files via unspecified vectors...

CloudBees Jenkins CI and LTS Directory Traversal Vulnerability

CloudBees Jenkins CI formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . A directory traversal vulnerability exists in CloudBees Jenkins CI versions prior to 1.600 and LTS versions prior to 1.596.1. A remote attack...

PCMan FTP Server Information Disclosure Vulnerability

PCMan FTP Server is FTP server software. A directory traversal vulnerability exists in PCMan FTP Server version 2.0.7, which can be exploited by a remote attacker to read arbitrary files via the RETR command inside the "... /" within the RETR command, this vulnerability can be exploited to read...

AjaXplorer Directory Traversal Vulnerability (CNVD-2015-06474)

AjaXplorer is a web-based remote file manager. The manager supports uploading and downloading files, online file editing, image previewing and more. A directory traversal vulnerability exists in AjaXplorer version 2.0. A remote attacker can exploit this vulnerability to read arbitrary files...

Endress+Hauser FieldCare CodeWrights HART Comm DTM Component Arbitrary File Read Vulnerability

Endress+Hauser FieldCare is a suite of applications for managing the FDT/DTM framework.CodeWrights HART Comm DTM is a component for providing communication protocol information to the FDT/DTM framework application. A security vulnerability in the CodeWrights HART Comm DTM group used by...

CVE-2015-6662

XML external entity XXE vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485...

CVE-2015-5163

The import task action in OpenStack Image Service Glance 2015.1.x before 2015.1.2 kilo, when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image...

Code injection

The import task action in OpenStack Image Service Glance 2015.1.x before 2015.1.2 kilo, when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image...

Red Hat JBoss BPM Suite dashbuilder XML External Entity Vulnerability

Red Hat JBoss BPM Suite is a business process management platform from Red Hat, Inc. that brings together all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation and business process monitoring. An XML external entity vulnerability exists in t...

Symantec Endpoint Protection Manager Directory Traversal Vulnerability

Symantec Endpoint Protection Manager SEPM is a suite of enterprise-grade virus protection software from Symantec USA. The software protects against malicious attacks such as viruses, worms, and Trojan horses. SEPM 12.1-RU6-MP1 A directory traversal vulnerability exists in the management console o...

CVE-2015-1941

The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to read arbitrary files via a crafted TCP packet to an unspecified port...

IBM Business Process Manager and WebSphere Lombardi Edition Directory Traversal Vulnerability

IBM Business Process Manager BPM is a comprehensive set of business process management platforms from IBM in the U.S. It provides a range of tools related to business process modeling, assembly, monitoring, and deployment.WebSphere Lombardi Edition WLE is the predecessor of the BPM product. A...

WordPress Plugin Paypal Currency Converter Basic For WooCommerce Absolute Path Traversal Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on PHP and MySQL servers.Paypal Currency Converter Basic For WooCommerce is one of the plugins that supports using Paypal payments in the WooCommerc...

CVE-2015-1851

OpenStack Cinder contains a vulnerability (CVE-2015-1851) where remote authenticated users could read arbitrary files via a crafted qcow2 header in the upload-to-image command. Affected series include OpenStack Cinder releases up to 2014.1.5 (icehouse), 2014.2.x up to 2014.2.4 (juno), and 2015.1....

UBUNTU-CVE-2015-3412

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the streamresolveincludepath function in ext/standard/streamsfuncs.c, as...

CVE-2015-0112

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.0.1, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Quality Manager RQM 2.0 through 2.0.1, 3.0 through 3.0.1.6, 4.0 through 4.0.7, and 5.0 through 5.0.2; Rational Team Concert RTC 2.0 through...