PT-2021-17100

Name of the Vulnerable Software and Affected Versions EPrints version 3.4.2 Description The issue allows remote attackers to read arbitrary files and possibly execute commands by providing crafted JSON or XML input to the "cgi/ajax/phrase" API endpoint. Recommendations For EPrints version 3.4.2,...

CVE-2021-3342: Improper Neutralization of Special Elements used in an OS Command

EPrints 3.4.2 allows remote attackers to read arbitrary files and possibly execute commands via crafted LaTeX input to a cgi/latex2png?latex= URI...

Atlassian Confluence < 6.13.18 / 6.14 < 7.4.6 / 7.5 < 7.8.3 Arbitrary File Read (CONFSERVER-60469)

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.18, 6.14.x prior to 7.4.6 or 7.5.x prior to 7.8.3. It is, therefore, affected by an arbitrary file read vulnerability in its ConfluenceResourceDownloadRewriteRule class...

Arbitrary File Read Vulnerability in SIYUCMS

SIYUCMS is a content management system based on ThinkPHP + AdminLTE. SIYUCMS suffers from an arbitrary file read vulnerability that can be exploited by an attacker to read arbitrary files...

CVE-2021-21064: Improper Limitation of a Pathname to a Restricted Directory

Magento UPWARD-php version 1.1.4 and earlier is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 and earlier due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which...

Atlassian Jira < 8.5.11 / 8.13.3 / 8.15.0 Arbitrary File Read (JRASERVER-72014)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.11, 8.13.3, or 8.15.0. It is, therefore, affected by limited arbitrary file read vulnerability related to the 'CachingResourceDownloadReadwriteRule' class due to an improp...

Arbitrary File Read Vulnerability in Streaming Media Management Server of Hangzhou Hikvision Digital Technology Co.

Hangzhou Hikvision System Technology Co., Ltd. is a provider of security products and industry solutions. An arbitrary file read vulnerability exists in the streaming media management server of Hangzhou Hikvision Digital Technology Co. Ltd, which can be exploited by attackers to read sensitive...

CVE-2021-21064

Magento UPWARD-php version 1.1.4 and earlier is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 and earlier due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which...

Arbitrary File Read Vulnerability in RSR Router of Riptide Networks Co.

Ltd. is a company mainly engaged in information system integration services; Internet virtual private network services; Internet management services and other items. An arbitrary file read vulnerability exists in the RSR router of Ruijie Networks Corporation, which can be exploited by an attacker...

Samsung router WLAN APs suffer from arbitrary file read vulnerability

Samsung China Investment Co., Ltd. is the headquarters of Samsung Group in China. By the end of 2008, 20 out of more than 30 companies under Samsung have invested in China, including Samsung Electronics, Samsung SDI, Samsung SDS and Samsung Electro-Mechanics. An arbitrary file read vulnerability...

CVE-2020-29448: Undefined Security Weakness

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect...

PT-2021-11667

Name of the Vulnerable Software and Affected Versions: Confluence Server versions prior to 6.13.18 Confluence Server versions 6.14.0 through 7.4.5 Confluence Server versions 7.5.0 through 7.8.2 Confluence Data Center versions prior to 6.13.18 Confluence Data Center versions 6.14.0 through 7.4.5...

PT-2021-11670

Name of the Vulnerable Software and Affected Versions: Jira Server and Jira Data Center versions prior to 8.5.11 Jira Server and Jira Data Center versions 8.6.0 through 8.13.3 Jira Server and Jira Data Center versions 8.14.0 through 8.14.x Description: The issue allowed unauthenticated remote...

CVE-2020-29453: Improper Limitation of a Pathname to a Restricted Directory

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access che...

RHEL 8 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0423 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

jenkins: Arbitrary file read vulnerability in workspace browsers

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks...

CVE-2020-35566

An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion...

CVE-2021-21475

Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this...

Security Bulletin: IBM QRadar SIEM is vulnerable to Arbitrary File Read (CVE-2020-4789)

Summary IBM QRadar SIEM is vulnerable to Arbitrary File Read Vulnerability Details CVEID: CVE-2020-4789 DESCRIPTION: IBM QRadar could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view...

CVE-2021-21475: Improper Limitation of a Pathname to a Restricted Directory

Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this...