CVE-2018-16475

The CVE-2018-16475 entry corresponds to a Path Traversal vulnerability in knightjs. The connected data shows that all versions of knightjs up to 0.0.1 are vulnerable due to lack of input validation, allowing an attacker to read arbitrary files on the server (e.g., via crafted URL paths such as .....

CVE-2018-18778

ACME minihttpd before 1.30 lets remote users read arbitrary files...

PT-2018-14591 · Phpyun · Phpyun

Name of the Vulnerable Software and Affected Versions: PHPYun version 4.6 Description: The issue allows remote attackers to read arbitrary files via directory traversal. This is possible through the function down sql action in the file /admin/model/database.class.php. The vulnerability can be...

GHSA-2FW5-RVF2-JQ56 Apache Camel's XSLT component allows remote attackers to read arbitrary files

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...

CVE-2017-17762

XML external entity XXE vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request involving util/xmlrpc/Handler.ashx...

GHSA-M2Q3-53FQ-7H66 Gollum Exposure of Sensitive Information

The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check...

CVE-2018-11640

XML External Entity XXE vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to read arbitrary files or cause a denial of service resource consumption...

CVE-2017-16859

The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command...

CVE-2018-12631

Redatam7 formerly Redatam WebServer allows remote attackers to read arbitrary files via /redbin/rpwebutilities.exe/text?LFN=../ directory traversal...

CVE-2018-12631

CVE-2018-12631 affects Redatam7 (formerly Redatam WebServer). A path-traversal in the /redbin/rpwebutilities.exe/text?LFN=../ endpoint allows remote attackers to read arbitrary files. The vulnerability is reported across multiple feeds (including Red Hat and CNVD/NVD entries) with the core issue ...

CVE-2018-5755

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet...

PT-2018-16138 · Node.Js · Node-Srv

Name of the Vulnerable Software and Affected Versions: node-srv versions prior to 2.1.1 Description: The node-srv node module has a Path Traversal issue due to a lack of validation of the url, allowing a malicious user to read the content of any file with a known path. This enables a remote...

SearchBlox XML External Entity Injection Vulnerability

SearchBlox is the U.S. SearchBlox company a set of open source and free of charge based on Lucene full-text search engine toolkit to build enterprise search and analytics solutions. The program provides a Web-based management interface , you can manage the entire search system . An XML external...

Luracast Restler Directory Traversal Vulnerability

Restler is a support for multiple protocols used to publish PHP classes and methods into a REST API open source framework . A directory traversal vulnerability exists in the public/examples/resources/getsource.php page of Luracast Restler used in the restler extension of TYPO3. A remote tele...

IceWarp Mail Server Path Traversal Vulnerability

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports email archiving, SmartAttach attachments, automatic migration and more. A directory traversal vulnerability exists in IceWarp Mail Server versions prior to 11.2. A remote attacker can exploit this vulnerability by...

Geist WatchDog Console XML External Entity Injection Vulnerability

Geist WatchDog Console is a suite of environmental monitoring software from Geist USA. An XML external entity injection vulnerability exists in Geist WatchDog Console version 3.2.2. A remote attacker can exploit this vulnerability to read arbitrary files with specially crafted XML data...

CVE-2018-10201

An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside the root directory of the web server. This vulnerability could be exploited remotely by a crafted URL without credentials, with .../ or ...\ or...

AppearTV XC5000 and XC5100 File Read Vulnerability

The AppearTV XC5000 and XC5100 are both versatile, carrier-grade broadcast devices from AppearTV Norway. A security vulnerability exists in the AppearTV XC5000 and XC5100 using firmware version 3.26.217. An attacker could send a specially crafted HTTP request to a web server running Maintenance...

PT-2018-5687 · Red Hat · Cockpit

Name of the Vulnerable Software and Affected Versions: Cockpit version 0.13.0 Description: The issue allows remote attackers to read arbitrary files or send TCP traffic to intranet hosts. This is related to the use of the discontinued aheinze/fetch url contents component, specifically via the url...

Design/Logic Flaw

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as demonstrated by use of '|' instead of '/' as a directory separator, in conjunction with a ".." sequence...