Arbitrary File Containment Vulnerability in VoIP Operation Support System of Kunshi Network Technology Co.

The VoIP operation support system of Kunshi Network Technology Co., Ltd. is a support system for small and medium-sized VoIP operation business. The product suffers from an arbitrary file inclusion vulnerability, which can be exploited by an attacker to read sensitive files such as the service...

VideoIQ Camera Local File Inclusion Vulnerability

VideoIQ Camera is prone to local file disclosure vulnerability SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Vanderbilt IP-Camera CCPW3025-IR / CVMW3025-IR - Local File Disclosure

Advisory Information ======================================== Title : Vanderbilt IP-Camera CCPW3025-IR + CVMW3025-IR Local File Inclusion Vendor Homepage : https://is.spiap.com/ Remotely Exploitable : Yes Tested on Camera types : CCPW3025-IR , CVMW3025-IR Product References :...

Liferay Path Traversal Vulnerability

Liferay is the U.S. Liferay company's set of J2EE-based portal solutions , it uses EJB and JMS and other technologies , and can be used as a Web publishing and sharing workspace , enterprise collaboration platforms , social networks and so on. A path traversal vulnerability exists in the...

Arbitrary File Read Vulnerability in Video Conferencing System of Tangqiao Technology (Hangzhou) Co.

Tangqiao Technology Hangzhou Co., Ltd. is the world's leading provider of converged video communication cloud services, video conferencing system is a remote collaborative video software. The product has an arbitrary file reading vulnerability, which can be exploited by an attacker to read server...

Hebei Xinhe Technology Co., Ltd. creative portal application system suffers from arbitrary file download vulnerability

The Creative Portal Application is a platform for website content publishing and management, and is a tool for building unit portal applications. The Creative Portal Application System of Hebei Xinhe Technology Co., Ltd. suffers from an arbitrary file download vulnerability. Allow attackers to...

Arbitrary File Download Vulnerability in Content Management System of Shandong Jierui Digital Technology Co.

The content management system of Shandong Jieri Digital Technology Co., Ltd. is a website management system used by enterprises and institutions. There is an arbitrary file download vulnerability in the content management system of Shandong Jereh Digital Technology Co. This vulnerability allows...

Arbitrary File Traversal Vulnerability in Reporter System of Shanghai Bingfeng Computer Network Technology Co.

Shanghai Bingfeng Computer Network Technology Co., Ltd. is a domestic VPN, Traffic Management, Behavior Management, Link Load Balancing, Next Generation Firewall equipment supplier and IT value solution provider. Bingfeng network reporter system is a set of data report management system. Shanghai...

AppCan vulnerability spree(AppCan weak password\XSS\SQL injection\sensitive files leaked\weak password\file upload vulnerability collection)-vulnerability warning-the black bar safety net

Test yourself to write the discuz scan tool robustness of the time to find a backup file http://bbs. appcan. cn//config/configucenter. php. bak Use uckey getshell failure,the test has changed uckey. To continue testing,found a suspected injection point http://edu. appcan. cn/traindetailnew. html?...

openSUSE SUSE Linux Enterprise Server Information Disclosure Vulnerability

openSUSE SUSE Linux Enterprise Server is an easy-to-install enterprise server version of the SUSE Linux operating system. An information disclosure vulnerability exists in openSUSE SUSE Linux Enterprise Server 11 SP 1, which allows local users to obtain sensitive information by reading files in a...

UBUNTU-CVE-2016-4036

The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory...

CVE-2016-0793

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

Design/Logic Flaw

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

CVE-2016-0793

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

CVE-2016-0793

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

CVE-2016-0793

CVE-2016-0793 affects WildFly (formerly JBoss AS) on Windows, where an incomplete blacklist in the servlet filter restriction mechanism lets remote attackers read sensitive files from WEB-INF or META-INF via requests containing lowercase or meaningless characters. The issue is tied to WildFly ver...

Gratipay: don't serve hidden files from Nginx

Hi Gratipay team, I noticed that your nginx setting is not secure. When you input https://grtp.co/.gitignore in your browser, it will download this hidden file. Even though this file does not contain some sensitive files, we still need to change nginx settings like bellow to forbid future hidden...

Allaire JRun Encoded JSP Request Directory Listing

The version of Allaire JRun running on the remote host is affected by an information disclosure vulnerability due to an issue in handling malformed URLs. An unauthenticated, remote attacker can exploit this, via a crafted request, to display a listing of files in arbitrary directories, which may...

Arbitrary File Containment Vulnerability in Polycom's (Polycom, Inc) Polycom RMX Family of Products

Polycom's PolycomRMX family of products are multipoint video conferencing system servers that provide easy-to-manage multipoint video and integrated conferencing services for next-generation real-time media conferencing platforms. The series of products have an arbitrary file inclusion...

Directory Traversal

Overview Versions of st prior to 0.2.5 are affected by a directory traversal vulnerability. Vulnerable versions fail to properly handle URL encoded dots, which caused %2e to be interpreted as . by the filesystem, resulting the potential for an attacker to read sensitive files on the server...