CVE-2020-27123: Exposed Dangerous Method or Function

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerability is due to an exposed IPC function. ...

CVE-2020-7763 Arbitrary File Read

This affects the package phantom-html-to-pdf before 0.6.1...

CVE-2020-7762 Arbitrary File Read

This affects the package jsreport-chrome-pdf before 1.10.0...

Arbitrary File Read

Overview jsreport-chrome-pdf is a Affected versions of this package are vulnerable to Arbitrary File Read. An Arbitrary File Read vulnerability exists in lib/conversion.js. PoC document.writewindow.location='../../../../../etc/passwd' Remediation Upgrade jsreport-chrome-pdf to version 1.10.0 or...

Arbitrary File Read

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Arbitrary File Read. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF. Not...

CVE-2020-27123

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerability is due to an exposed IPC function. ...

Cisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerability is due to an exposed IPC function. ...

grafana: arbitrary file read via MySQL data source

Grafana has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations...

Moderate: Red Hat Security Advisory: grafana security, bug fix, and enhancement update

An update for grafana is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Zendo has an arbitrary file read vulnerability

Zendo is a homegrown open source project management software. Zendo suffers from an arbitrary file read vulnerability. An attacker can exploit the vulnerability to obtain sensitive information...

PT-2020-4667

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client affected versions not specified Description The issue is related to an exposed interprocess communication IPC function in the Cisco AnyConnect Secure Mobility Client. This could allow an authenticated,...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : AccountsService vulnerabilities (USN-4616-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4616-1 advisory. Kevin Backhouse discovered that AccountsService incorrectly dropped privileges. A local user could possibly use this issue to cau...

ALSA-2020:4682 Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. The following packages have been upgraded to a later upstream version: grafana 6.7.4. BZ1807323 Security Fixes: grafana: XSS vulnerability via a column style on the "Dashboard Table Panel...

CVE-2020-9368

The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal...

PT-2020-20615

Name of the Vulnerable Software and Affected Versions PrestaShop Module Olea Gift On Order versions through 5.0.8 Description The issue allows an unauthenticated user to read arbitrary files on the server via a directory traversal attack using the getfile.php endpoint with a file parameter, such ...

CVE-2020-9368: Improper Limitation of a Pathname to a Restricted Directory

The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal...

CVE-2020-15703: Improper Limitation of a Pathname to a Restricted Directory

There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an...

Arbitrary File Read

Overview phantom-html-to-pdf is a Convert html to pdf using phantomjs Affected versions of this package are vulnerable to Arbitrary File Read. PoC var fs = require'fs' var conversion = require"phantom-html-to-pdf"; conversion.allowLocalFilesAccess = false conversion html:...

CVE-2020-27993: Improper Limitation of a Pathname to a Restricted Directory

Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files...

Pulse Secure Pulse Connect Secure Input Validation Error Vulnerability (CNVD-2020-60092)

Pulse Secure Pulse Connect Secure a.k.a. PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure in the United States. Pulse Connect Secure versions prior to 9.1R9 have an input validation error vulnerability that can be exploited by an attacker to execute an...