LibXfont, LibXfont2: Arbitrary file access

Background X.Org Xfont library. Description It was discovered that libXfont incorrectly followed symlinks when opening font files. Impact A local unprivileged user could use this flaw to cause the X server to access arbitrary files, including special device files. Workaround There is no known...

CVE-2017-3891

In BlackBerry QNX Software Development Platform SDP 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled on networks comprising two or more QNet nodes could allow an attacker to access local and remote files or take ownership of files on oth...

Directory Traversal

Xbhxbh, wangshuai, Tinyserver, Nopach, and Nodejs.Jseidl are vulnerable to directory traversal attacks. By putting ../ into a URL, attackers are able to access files outside of the intended directories...

Directory Traversal

Overview Affected versions of mockserve resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...

Directory Traversal

Overview Affected versions of calmquist.static-server resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the...

Directory Traversal

Overview Affected versions of datachannel-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerabl...

Directory Traversal

Overview Affected versions of easyquick resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...

The vulnerability of Qualcomm’s TrustZone microprogramming software technology allows a hacker to gain access to local files.

The vulnerability of the TrustZone technology a DRM sub-program of Qualcomm’s Secure Execution Environment for Android from the CAF repository is related to pointer dereferencing errors. Exploiting this vulnerability could allow a remote attacker to gain access to local files...

Ubuntu 16.10 / 17.04 : lightdm vulnerability (USN-3285-1)

Tyler Hicks discovered that LightDM did not confine the user session for guest users. An attacker with physical access could use this issue to access files and other resources that they should not be able to access. In the default installation, this includes files in the home directories of other...

CVE-2017-6590

An issue was discovered in network-manager-applet aka network-manager-gnome in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use this issue at the default Ubuntu login screen to access local files and execute arbitrary commands as the lightdm user. The exploitation...

Novell Open Enterprise Server Information Disclosure Vulnerability

The Novell Open Enterprise Server OES is an enterprise-class server from the American company Novell that provides network services, file and print services, and network management capabilities. An information disclosure vulnerability exists in Novell OES. A remote attacker could exploit the...

Docker Engine is vulnerable

Docker Engine is a set of lightweight runtime environments and package management tools from Docker, Inc. A security vulnerability exists in Docker Engine version 1.12.2, which stems from an enabled environment condition configured with the wrong condition policy. An attacker can exploit the...

Trend Micro Internet Security Access Restriction Vulnerability

Trend Micro Internet Security is a set of Trend Micro Trend Micro integrated with personal firewall, anti-virus, anti-spam and other features in one network security software. A security vulnerability exists in versions 8 and 10 of Trend Micro Internet Security. The vulnerability can be exploited...

Интерактивная биржа Петербурга - External URLs, WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application Интерактивная биржа Петербурга published at the 'play' market has multiple vulnerabilities...

LMCMS background arbitrary file download vulnerability

LMCMS Leming CMS system is a web content management system developed in Java language, developed by Beijing Leming Zhixin Technology Co., Ltd. and distributed under commercial license. LMCMS Leming CMS system's management background full media library section of the file management provided in th...

New Relic: Unauthorized Access

Summary of Findings ------------------------------- The remote server https://download.newrelic.com allowed unauthenticated access to special access files that are only intended to be accessible after contacting the New Relic program managers as seen below. Exploiting the...

Advantech WebAccess Security Restriction Bypass Vulnerability

WebAccess HMI/SCADA software provides remote control and management, allowing users to easily view and configure automation devices in facility management systems, power stations and building automation systems. A security vulnerability exists in Advantech WebAccess versions prior to 8.1, which c...

Framework: Directory traversal

A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place...

Microsoft Windows NT 4.0 Recycle Bin Pre-created Folder Vulnerability

No description provided by source. Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 Recycle Bin Pre-created Folder Vulnerability source: http://www.securityfocus.com/bid/963/info When an NT user uses the Recycle Bin for the first time on a given partition, a folder is created in the \Recycler...

CVE-2013-5010

The Application/Device Control ADC component in the client in Symantec Endpoint Protection SEP 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 does not properly handle custom polices, which allows local users to bypass intended...