Netflix Spinnaker Code Issue Vulnerability

Netflix Spinnaker is a continuous delivery platform from the American company Netflix. The platform serves as a cloud platform deployment tool that supports Google, Microsoft, Pivotal, and other cloud platforms, providing out-of-the-box cluster management and deployment capabilities. Netflix...

Vulnerability of the /processReportGetter.php component of the KTS “Mayak” system, which allows a hacker to gain access to and read arbitrary files.

The vulnerability of the /processReportGetter.php component of the KTS “Mayak” is related to errors in the logic of the web application’s operation. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to and read arbitrary files...

CVE-2020-25172 B. Braun OnlineSuite

A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files...

Cisco SD-WAN vManage Path Traversal Vulnerability

Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. A path traversal vulnerability exists in the Web management interface of Cisco SD-WAN vManage 20.1.12 and earlier. The vulnerability stems from insufficient authentication of HTTP requests...

CVE-2020-7758

This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server...

PT-2020-19771 · Browserless · Browserless-Chrome

Name of the Vulnerable Software and Affected Versions: browserless-chrome versions prior to 1.43.0 Description: The issue affects browserless-chrome, where user input from the "workspace endpoint" is used to create a file path filePath. This filePath is then fetched and sent back to the user,...

CVE-2020-3550

A vulnerability in the sfmgr daemon of Cisco Firepower Management Center FMC Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to perform directory traversal and access directories outside the restricted path. The vulnerability is due to...

Directory Traversal Vulnerability in Advantech iView² SNMP Management Software Co***.class File

Advantech is a global leader in the intelligent systems industry. A directory traversal vulnerability exists in the Co.class file of the Advantech iView² SNMP management software. An attacker can exploit the vulnerability to access arbitrary files within the station and disclose sensitive...

Code injection

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller...

PT-2020-20064 · Pulse · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R8.2 Description: A vulnerability in the Pulse Connect Secure admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML Extern...

DEBIAN-CVE-2014-10401

An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the fdir attribute...

CVE-2020-25257

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows XXE attacks for read/write access to arbitrary files...

Citrix StoreFront Security Update - Security Bulletin

Description A high severity issue has been discovered in Citrix StoreFront that, if exploited, would allow an attacker who is authenticated on thesame Microsoft Active Directory domain as a Citrix StoreFront server to read arbitrary files from that server. This issue has the following identifier:...

Directory Traversal

icingaweb is vulnerable to directory traversal. The vulnerability exists as arbitrary files are readable by the process running Icinga Web 2...

WordPress Add From Server plugin <= 3.4.2 - Authenticated Path Traversal leading to Arbitrary File Access vulnerability

Authenticated Path Traversal leading to Arbitrary File Access vulnerability found by HoanHP in WordPress Add From Server plugin versions = 3.4.2. Solution Update the WordPress Add From Server plugin to the latest available version at least 3.4.3...

Cellopoint Cellos Server-Side Request Forgery Vulnerability

Cellos is a Linux-based operating system optimized for mail security and mail scanning performance by Cellopoint. A server-side request forgery vulnerability exists in Cellopoint Cellos 4.1.10 Build 20190922. The vulnerability stems from the product's failure to properly validate incoming URLs,...

CVE-2020-17385

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly, which allows unauthorized user to launch Path Traversal attack and access arbitrate file on the system...

CVE-2020-17386

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system...

CVE-2020-17386

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system...

CVE-2020-17386 Cellopoint CelloOS - Server-Side Request Forgery (SSRF)

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system...