CVE-2020-2293

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller...

Arbitrary file read vulnerability in Persona

Persona 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller. As of publication of this advisory, there is no fix...

CVE-2020-2293: Undefined Security Weakness

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller...

CVE-2020-4776

A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted file path in URL request to view arbitrary files on the system. IBM X-Force ID:...

CVE-2020-15175: Files or Directories Accessible to External Parties

In GLPI before version 9.5.2, the ​pluginimage.send.php​ endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”...

CVE-2020-26603: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on Samsung mobile devices with O8.x, P9.0, and Q10.0 software. Sticker Center allows directory traversal for an unprivileged process to read arbitrary files. The Samsung ID is SVE-2020-18433 October 2020...

CVE-2020-15236: Improper Limitation of a Pathname to a Restricted Directory

In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is...

CVE-2020-25623: Improper Limitation of a Pathname to a Restricted Directory

Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used...

CVE-2020-5789

Relative Path Traversal in Teltonika firmware TRB2R00.02.04.3 allows a remote, authenticated attacker to read the contents of arbitrary files on disk...

Selenium arbitrary file read

If there is an open selenium web driver, a remote attacker can send requests to the victims browser. In certain cases this can be used to access to the remote file system. Module Options msf use auxiliary/gather/selenium/fileread msf undefinedfileread show actions ...actions... msf...

CVE-2020-5789: Improper Limitation of a Pathname to a Restricted Directory

Relative Path Traversal in Teltonika firmware TRB2R00.02.04.3 allows a remote, authenticated attacker to read the contents of arbitrary files on disk...

CVE-2020-8256

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity XXE vulnerability...

CVE-2020-21525

Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it...

CVE-2020-8256

A vulnerability in the Pulse Connect Secure 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity XXE vulnerability...

Unauthorized Arbitrary File Read Vulnerability in jeewms

jeewms is a JAVA-based warehouse management system . jeewms has an unauthorized arbitrary file read vulnerability that can be exploited by an attacker to read any file on the server without authorization...

Pre-Authorization Arbitrary File Read [Confluence, Jira, Crowd]

The VULN ticket can be seen at: https://asecurityteam.atlassian.net/browse/VULN-196971 ---- This issue was reported by an external researcher at https://securitysd.atlassian.net/browse/SEC-2455 . ---- Hello, I am Amit Laish, a security researcher from GE Digital. During one of our assessments we...

PT-2020-6854

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 22.3.x through 22.3.4.5 Erlang/OTP versions 23.x through 23.0 Description The issue allows an attacker to send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used. This is related to...

CVE-2020-24624: Improper Limitation of a Pathname to a Restricted Directory

Unathenticated directory traversal in the DownloadServlet class execute method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-3143: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the video endpoint API xAPI of Cisco TelePresence Collaboration Endpoint CE Software, Cisco TelePresence Codec TC Software, and Cisco RoomOS Software could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. The vulnerability is...

CVE-2020-8200: Improper Authentication

Improper authentication in Citrix StoreFront Server 1912.0.1000 allows an attacker who is authenticated on the same Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server...