CVE-2020-10629

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

Path Traversal

Overview Versions of sapper prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing URL-encoded ../. You may test a sapper application running in prod mode with curl -vvv...

CVE-2019-1734 Cisco FXOS and NX-OS Software Sensitive File Read Information Disclosure Vulnerability

A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that should be restricted. The attacker could use this information to conduct additional reconnaissance...

Juniper JSA10975

According to the self reported version of Junos OS on the remote device it is affected by a path traversal vulnerability with the Next-Generation Routing Engine. A local authenticated attacker can exploit this, to read sensitive file systems. Note that Nessus has not tested for this issue but has...

RancherOS 1.6.x < 1.6.28 / 2.0.x < 2.0.15 / 2.1.x < 2.1.10 / 2.2.x < 2.2.4 Arbitrary File Read

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

PT-2019-9040 · Clickhouse · Clickhouse Mysql Client

Name of the Vulnerable Software and Affected Versions: ClickHouse MySQL client versions prior to 1.1.54390 Description: The issue concerns the "LOAD DATA LOCAL INFILE" functionality in the ClickHouse MySQL client, which was enabled and allowed a malicious MySQL database to read arbitrary files fr...

Vxscan - Comprehensive Scanning Tool

Python3 comprehensive scanning tool, mainly used for sensitive file detection directory scanning and js leak interface, WAF/CDN identification, port scanning, fingerprint/service identification, operating system identification, weak password detection, POC scanning, SQL injection, winding Pass CD...

CVE-2019-7579

An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dynamic/js/setup.js.localized file on the router's webserver, allowing for an attacker to identify possible passwords that the system uses to...

CVE-2019-12274

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

CVE-2019-12274

In Rancher 1 and 2 through 2.2.3, unprivileged users if allowed to deploy nodes can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as...

CVE-2019-12274

CVE-2019-12274 affects Rancher 1 and 2 up to 2.2.3. Unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane by posting data via node driver options, enabling reading of sensitive files such as /root/.kube/config or /var/lib/rancher/management-state/cr...

Cisco FXOS and NX-OS Software Sensitive File Read Information Disclosure Vulnerability

A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that should be restricted. The attacker could use this information to conduct additional reconnaissance...

CVE-2019-8993 TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File

The administrative web server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution f...

TIBCO Security Advisory: April 24, 2019 - TIBCO Active MatrixService Grid -2019-8993

TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File Original release date: April24, 2019 Last revised: CVE-2019-8993 Source: TIBCO Software Inc. TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File Original release date:...

TIBCO Security Advisory: April 24, 2019 - TIBCO Active MatrixService Grid -2019-8993

TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File Original release date: April24, 2019 Last revised: CVE-2019-8993 Source: TIBCO Software Inc. TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File Original release date:...

Media File Manager <= 1.4.2 - Authenticated Multiple Vulnerabilities

Following the PoC you can combine the vulnerabilities to obtain PHP code execution and read sensitive file. By default the File Manager can only be used by Administrator users, however, any user role can be configured to use it. PoC Diretory Trasversal: POST /wordpress/wp-admin/admin-ajax.php...

Arbitrary File Read Vulnerability in OurPHP v1.8.0

OURPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. OurPHP v1.8.0 suffers from an arbitrary file reading vulnerability. An attacker can exploit the vulnerability to read sensitive files...

Multiple Cisco Products FXOS Software and NX-OS Software Privilege Access Control Vulnerabilities

Cisco Firepower 4100 Series Next-Generation Firewalls are products of Cisco Corporation.Cisco Firepower 4100 Series Next-Generation Firewalls are 4100 Series firewalls.Nexus 1000V Series Switches are 1000V Series switches.FXOS Software is a set of firewall software running on Cisco security...

CVE-2017-6157

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.5.0 - 11.5.4, virtual servers with a configuration using the HTTP Explicit Proxy functionality and/or SOCKS profile are vulnerable to an...

Multiple Hitachi Products XML External Entity Information Disclosure Vulnerability

Hitachi Device Manager is a suite of mobile device management software; Replication Manager is a suite of data replication software that simplifies Hitachi storage systems. An XML external entity information disclosure vulnerability exists in multiple Hitachi products. A remote attacker could...