Arbitrary File Read Vulnerability in Streaming Media Management Server of Hangzhou Hikvision Digital Technology Co.

Hangzhou Hikvision System Technology Co., Ltd. is a provider of security products and industry solutions. An arbitrary file read vulnerability exists in the streaming media management server of Hangzhou Hikvision Digital Technology Co. Ltd, which can be exploited by attackers to read sensitive...

CVE-2021-21064

Magento UPWARD-php version 1.1.4 and earlier is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 and earlier due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which...

Arbitrary File Read Vulnerability in RSR Router of Riptide Networks Co.

Ltd. is a company mainly engaged in information system integration services; Internet virtual private network services; Internet management services and other items. An arbitrary file read vulnerability exists in the RSR router of Ruijie Networks Corporation, which can be exploited by an attacker...

CVE-2020-29448: Undefined Security Weakness

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect...

RHEL 8 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0423 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Samsung router WLAN APs suffer from arbitrary file read vulnerability

Samsung China Investment Co., Ltd. is the headquarters of Samsung Group in China. By the end of 2008, 20 out of more than 30 companies under Samsung have invested in China, including Samsung Electronics, Samsung SDI, Samsung SDS and Samsung Electro-Mechanics. An arbitrary file read vulnerability...

PT-2021-11667

Name of the Vulnerable Software and Affected Versions: Confluence Server versions prior to 6.13.18 Confluence Server versions 6.14.0 through 7.4.5 Confluence Server versions 7.5.0 through 7.8.2 Confluence Data Center versions prior to 6.13.18 Confluence Data Center versions 6.14.0 through 7.4.5...

CVE-2020-29453: Improper Limitation of a Pathname to a Restricted Directory

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access che...

PT-2021-11670

Name of the Vulnerable Software and Affected Versions: Jira Server and Jira Data Center versions prior to 8.5.11 Jira Server and Jira Data Center versions 8.6.0 through 8.13.3 Jira Server and Jira Data Center versions 8.14.0 through 8.14.x Description: The issue allowed unauthenticated remote...

jenkins: Arbitrary file read vulnerability in workspace browsers

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks...

CVE-2020-35566

An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion...

CVE-2021-21475

Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this...

Security Bulletin: IBM QRadar SIEM is vulnerable to Arbitrary File Read (CVE-2020-4789)

Summary IBM QRadar SIEM is vulnerable to Arbitrary File Read Vulnerability Details CVEID: CVE-2020-4789 DESCRIPTION: IBM QRadar could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view...

CVE-2021-21475: Improper Limitation of a Pathname to a Restricted Directory

Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. Due to this...

Advantech iView

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: iView Vulnerabilities: SQL Injection, Path Traversal, Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow...

Serv-U FTP Server < 15.2.2 Hotfix 1 Arbitrary File Read/Write

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files that include users' password hashes that is world readable and writable. An unprivileged Windows user having access to the server's filesystem can add an FTP user by copying a valid profile file to thi...

GitLab: Kroki Arbitrary File Read/Write

Summary In short, I've found a potentially weird bug in asciidoctor that could lead to arbitrary file read/write in asciidoctor-kroki even though Gitlab have already made an attempt to disable kroki-plantuml-include lib/gitlab/asciidoc.rb rb module Gitlab Parser/renderer for the AsciiDoc format...

ArcGIS Server has an Arbitrary File Read Vulnerability

ArcGIS Server is ESRI released to provide Web-oriented spatial data services for an enterprise-class GIS software platform. ArcGIS Server has an arbitrary file read vulnerability that can be exploited by an attacker to obtain sensitive information...

Arbitrary file read vulnerability exists in ShopXO (CNVD-2021-15822)

ShopXO is an open source enterprise-level open source e-commerce system. ShopXO has an arbitrary file read vulnerability that can be exploited by attackers to obtain sensitive information...

Apple macOS Arbitrary File Read Vulnerability

Apple macOS is a specialized operating system developed by Apple for Mac computers. An arbitrary file read vulnerability exists in Apple macOS, which arises from an application not properly applying security restrictions within the APFS component of macOS. A local user can read arbitrary files on...