Security Bulletin: The Elastic Storage Server and the GPFS Storage Server are affected by a vulnerability in IBM Spectrum Scale

Summary The Elastic Storage Server and the GPFS Storage Server are affected by a multiple GSKit vulnerability in IBM Spectrum Scale. Vulnerability Details CVEID: CVE-2018-1431 DESCRIPTION: A vulnerability in GSKit affects IBM Spectrum Scale that could allow a local attacker to obtain control of t...

CVE-2018-12909

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem that the webserver user has access to via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment...

CVE-2018-12563

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of support for file: URLs, a user can force lava-server-gunicorn to download any file from the filesystem if it's readable by lavaserver and valid yaml...

Kitura Information Disclosure Vulnerability

Kitura is a set of Web frameworks and Web servers based on the Swift language . A security vulnerability exists in Kitura 2.3.0 and earlier versions. The vulnerability can be exploited by an attacker to access unauthorized files or folders with the help of a specially crafted URL, resulting in...

WordPress Ultimate Member Plugin < 2.0.4 Multiple Vulnerabilities

The WordPress plugin Copyright C 2018 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

Directory Traversal

wuzhuangserver is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of ../ sanitization on the user input, allowing attackers to access files outside of the server's scope...

Directory Traversal

songcaihong is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of ../ sanitization on the user input, allowing attackers to access files outside of the server's scope...

FreeBSD : SquirrelMail -- post-authentication access privileges (928d5c59-2a5a-11e8-a712-0025908740c2)

Florian Grunow reports : An attacker able to exploit this vulnerability can extract files of the server the application is running on. This may include configuration files, log files and additionally all files that are readable for all users on the system. This issue is post-authentication. That...

CVE-2017-14384

In Dell Storage Manager versions earlier than 16.3.20, the EMConfigMigration service is affected by a directory traversal vulnerability. A remote malicious user could potentially exploit this vulnerability to read unauthorized files by supplying specially crafted strings in input parameters of th...

Path Traversal

general-file-server is vulnerable to path traversal attacks. Using a string including ../, attackers can traverse the server and any file with a known path...

TRITON AP-EMAIL File Access Vulnerability

Websense TRITON AP-EMAIL is a suite of email security solutions from Websense USA. The solution identifies targeted attacks, high-risk users and insider threats, while enabling mobile workers to take countermeasures and ensure their secure use of technologies such as Microsoft Office 365. The...

CVE-2016-9983

IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user with special privileges to view files that they should not have access to. IBM X-Force ID: 120275...

Directory Traversal

serve is vulnerable to directory traversal attacks. Attackers are able to access file outside of the intended directory through the use of .. in a request...

Google Chrome Devtools Unauthorized File Access Vulnerability

Google Chrome is a popular web browser. An unauthorized file access vulnerability exists in Google Chrome Devtools, which allows remote attackers to exploit the vulnerability to build malicious web pages that can be parsed by the user and can be used to obtain sensitive information...

OPENSUSE-SU-2017:0565-1 Security update of chromium

Google chromium was updated to 56.0.2924.87: Various small fixes Disabled option to enable/disable plugins in the chrome://plugins - Changed the build requirement of libavformat to library version 57.41.100, as included in ffmpeg 3.1.1, as only this version properly supports the public AVStream A...

chromium-browser: unauthorised file access in devtools

Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page...

Directory Traversal

hostr is vulnerable to directory traversal attacks. These attacks can be conducted by sending a request using a small program with ../ in the input. The server will then serve up files outside of the intended directory. Note: These attacks cannot be conducted using cURL...

Design/Logic Flaw

Vulnerability in Novell Open Enterprise Server OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989 might allow authenticated remote...

CVE-2016-5763

Vulnerability in Novell Open Enterprise Server OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989 might allow authenticated remote...

Cisco IOS and IOS XE Software Application-Hosting Framework Unauthorized File Access Vulnerability

Cisco IOS and IOS XE Software are operating systems developed by Cisco in the United States for its network devices. An unauthorized file access vulnerability exists in the Application-Hosting Framework component of Cisco IOS and IOS XE Software. When the Iox feature setting is enabled, a remote...