b3log Wide Arbitrary File Read/Write Vulnerability

b3log Wide is a set of Web-based Go language integrated development environment IDE . An arbitrary file read/write vulnerability exists in versions of b3log Wide prior to 1.6.0, which can be exploited by an attacker to access arbitrary files...

PT-2019-13474 · B3Log · B3Log Wide

Name of the Vulnerable Software and Affected Versions: b3log Wide versions prior to 1.6.0 Description: The issue allows an attacker to access arbitrary files through three types of attacks. First, an attacker can write and execute code in the editor to read arbitrary files. Second, an attacker ca...

The vulnerability in the Apache Thrift web server for Node.js exists due to an incorrect pathname limitation for the restricted access directory, allowing attackers to gain access to arbitrary files.

The vulnerability in the Apache Thrift web server for Node.js exists due to an incorrect pathname limitation for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain access to arbitrary files...

CVE-2019-1894

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker with administrator privileges to overwrite or read arbitrary files on the underlying operating system OS of an affected device. The vulnerability is due to improper input validation...

Cisco Enterprise NFV Infrastructure Software Arbitrary File Read/Write Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. An arbitrary file read/write vulnerability exists in Cisco Enterprise NFV...

xml entity injection vulnerability in ctcms version 2.0.2

Chongsheng Network Technology is an emerging network technology limited company. It has developed Cscms portal content management system, Ctcms network video education management system, polymerization payment, and a multi-merchant card issuance platform management system. ctcms2.0.2 version of t...

Sahi pro 7.x/8.x - Directory Traversal Vulnerability

Exploit for multiple platform in category web applications Exploit Title: Sahi pro :/s/dyn/Loghighlight?href=../../../../windows/win.ini&n=1selected 0day.today 2019-06-18...

Sahi pro 7.x8.x - Directory Traversal

Sahi pro 7.x8.x - Directory Traversal Exploit Title: Sahi pro :/s/dyn/Loghighlight?href=../../../../windows/win.ini&n=1selected...

Sahi Pro 7.x / 8.x Directory Traversal

Exploit Title: Sahi pro :/s/dyn/Loghighlight?href=../../../../windows/win.ini&n=1selected...

CVE-2018-20470

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal arbitrary file access vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files...

CVE-2018-20470

Tyto Sahi Pro through 8.0.0 is affected by a Local File Inclusion / directory traversal vulnerability in the web reports module, enabling an attacker to view sensitive server files. Affected: Tyto Sahi Pro versions through 7.x.x and 8.0.0 (per CVE-2018-20470). Root cause: improper handling of fil...

GHSA-68GR-CMCP-G3MJ Directory Traversal in lactate

A crafted GET request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root. This allows for a remote attacker to gain access to arbitrary files on the filesystem that the process has acce...

Mozilla Firefox Arbitrary File Access Vulnerability

Mozilla Firefox, commonly known as "Firefox" in Chinese, is a free and open-source web browser that uses the Gecko typography engine and supports a variety of operating systems, such as Windows, Mac OS X and GNU/Linux, among others. Mozilla Firefox suffers from an arbitrary file access...

CVE-2019-3722

Affected software/Component: Dell EMC OpenManage Server Administrator (OMSA). Vulnerability: XML External Entity (XXE) injection in OMSA prior to 9.1.0.3 and prior to 9.2.0.4. Root cause: XXE vulnerability allowing external entities to be processed in XML requests. Impact: Potential remote read o...

Kubernetes 1.3.x < 1.7.14 / 1.8.x < 1.8.9 / 1.9.x < 1.9.4 multiple vulnerabilities

The version of Kubernetes installed on the remote host is version 1.3.x prior to 1.7.14, 1.8.x prior to 1.8.9 or 1.9.x prior to 1.9.4. It is, therefore, affected by multiple vulnerabilities. - An arbitrary file access vulnerability exists in containers using subpath volume mounts. An authenticate...

CVE-2018-16716

A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary files i.e., significant information disclosure or file deletion via the nph-viewgif.cgi query string...

CVE-2018-16716

Summary of CVE-2018-16716 Affected software: NCBI ToolBox legacy versions 2.0.7 through 2.2.26. Vulnerability: Path traversal via viewcgi.cgi (and potential file deletion via nph-viewgif.cgi), enabling reading of arbitrary server files and significant information disclosure. Root cause (per sourc...

CVE-2019-11538

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1, an NFS problem could allow an authenticated attacker to access the contents of arbitrary files on the affected device...

CVE-2019-11515

core/classes/dbbackup.php in Gila CMS 1.10.1 allows admin/dbbackup?download= absolute path traversal to read arbitrary files...

Pulse Connect Secure and Pulse Policy Secure Multiple Security Vulnerabilities

Description Pulse Connect Secure and Pulse Policy Secure are prone to the following vulnerabilities: 1. An arbitrary file read vulnerability 2. An arbitrary file-write vulnerability 3. A session-hijacking vulnerability 4. Multiple cross-site scripting vulnerabilities 5. Multiple information...