Service Finder Booking < 3.2 - Unauthenticated Local File Disclosure

The premium Service Finder Booking WordPress plugin was vulnerable to a Local File Disclosure vulnerability that could allow unauthenticated users to include arbitrary files on the server. PoC http://victim.com/wp-content/plugins/sf-booking/lib/downloads.php?file=/index.php...

Design/Logic Flaw

The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader...

Yawcam 0.6.0 Directory Traversal

Directory traversal vulnerability in Yawcam webcam server ========================================================= Overview -------- Affected Versions: Yawcam 0.2.6 through 0.6.0 Patched Versions: Yawcam 0.6.1 Vendor: Yawcam Vendor URL: http://www.yawcam.com CVE: CVE-2017-17662 Credit: David...

CVE-2014-1859

1 core/tests/testmemmap.py, 2 core/tests/testmultiarray.py, 3 f2py/f2py2e.py, and 4 lib/tests/testio.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file...

PYSEC-2018-33

init.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file...

PYSEC-2018-34

1 core/tests/testmemmap.py, 2 core/tests/testmultiarray.py, 3 f2py/f2py2e.py, and 4 lib/tests/testio.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file...

CVE-2014-5509

clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$...

CVE-2014-1859

CVE-2014-1859 affects NumPy up to version 1.8.1 and allows local users to write to arbitrary files via a symlink attack on a temporary file. The vulnerable components listed in the CVE entry are: core/tests/test_memmap.py, core/tests/test_multiarray.py, f2py/f2py2e.py, and lib/tests/test_io.py. T...

Unlimited File Upload Vulnerability in Western Digital My Cloud NAS Devices

The Western Digital MyCloud NAS is a network attached storage device. An unrestricted file upload vulnerability exists in the Western Digital My Cloud NAS device that could allow a remote attacker to upload an arbitrary file to a server running on a vulnerable Internet-connected storage device...

Path traversal

An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition NVE 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could access arbitrary files on the server file system...

Design/Logic Flaw

The "Sql Run Query" panel in WP-DBManager aka Database Manager plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOADFILE in an INSERT statement...

CVE-2014-8336

The "Sql Run Query" panel in WP-DBManager aka Database Manager plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOADFILE in an INSERT statement...

CVE-2014-8336

The WP-DBManager WordPress plugin (pre-2.7.2) contains a vulnerability in the Sql Run Query panel that allows remote read of arbitrary files by exploiting insufficient query restriction, demonstrated via LOAD_FILE in an INSERT statement. Affected product: WP-DBManager plugin for WordPress. Impact...

NetGain Systems Enterprise Manager Directory Traversal Vulnerability (CNVD-2018-01238)

NetGain Enterprise Manager is an end-to-end IT infrastructure monitoring platform. NetGain Systems Enterprise Manager suffers from a directory traversal vulnerability in its implementation, which can be exploited by an attacker to access or read arbitrary files...

NetGain Systems Enterprise Manager Directory Traversal Vulnerability (CNVD-2018-01230)

NetGain Enterprise Manager is an end-to-end IT infrastructure monitoring platform. NetGain Systems Enterprise Manager suffers from a directory traversal vulnerability in its implementation, which can be exploited by an attacker to access or read arbitrary files...

Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance khuploadfile Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Moonshot Provisioning Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the khuploadfile.cgi file. The issue results...

CVE-2014-3630

XML external entity XXE vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data...

Xxe

XML external entity XXE vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data...

CVE-2014-3630

XML external entity XXE vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data...

CVE-2014-4978

The rsfiltergraph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on 1 /tmp/rs-filter-graph.png or 2 /tmp/rs-filter-graph...