CVE-2019-8093

An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage file upload controller for downloadable products to read/delete an arbitary files...

CVE-2010-2783

The CVE-2010-2783 entry concerns IcedTea6 prior to 1.7.4, where Extended JNLP Services allow unsigned applications to read and write arbitrary files. This is the core root cause described in multiple sources (IcedTea6

Cisco SPA100 Information Disclosure Vulnerability (CNVD-2019-36890)

The Cisco SPA100 Series is an analog phone adapter from Cisco that allows your standard analog phone to access Internet telephony services through an RJ-11 phone port. An information disclosure vulnerability exists in the Web-based management interface of the Cisco SPA100 Series 1.4.1 SR3 and...

cPanel Security Feature Issue Vulnerability (CNVD-2019-36153)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security signature issue vulnerability exists in versions prior to cPanel 71.9980.37. An attacker can exploit this vulnerabilit...

Magento Information Disclosure Vulnerability (CNVD-2019-35415)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento in the information leakage vulnerability , an attacker can exploit the vulnerability to read / delete...

Rails Arbitrary File Content Disclosure

A File disclosure vulnerability has been identified on this Rails Application. This vulnerabilities exists in Action View in rails versions 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.22.11.1 or 6.0.0.beta3 whereby a remote, unauthenticated attacker can read the contents of arbitrary files on the target system...

Debian DSA-4542-1 : jackson-databind - security update

It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attempting deserialization. This allowed an attacker providing maliciously crafted input to perform code execution, or read arbitrary files on the server....

WordPress Advanced Access Manager plugin <= 5.9.8.1 - Arbitrary File Access/Download vulnerability

Arbitrary File Access/Download vulnerability found by "Props to Ov3rfly" in WordPress Advanced Access Manager plugin versions = 5.9.8.1. Solution Update the WordPress Advanced Access Manager plugin to the latest available version at least 5.9.9...

Advanced Access Manager < 5.9.9 - Arbitrary File Access/Download

Advanced Access Manager before Version 5.9.9 allows reading arbitrary files without checking whether a user is allowed to read the given file. This way one can download the wp-config.php file and get access to the database, which is publicly reachable on many servers. PoC...

Advanced Access Manager < 5.9.9 - Arbitrary File Access/Download

Advanced Access Manager before Version 5.9.9 allows reading arbitrary files without checking whether a user is allowed to read the given file. This way one can download the wp-config.php file and get access to the database, which is publicly reachable on many servers...

The vulnerability of the command-line interface (CLI) of Cisco Enterprise NFV Infrastructure Software (NFVIS) allows a attacker to read and modify arbitrary files on a vulnerable device.

The vulnerability of the command-line interface CLI of Cisco Enterprise NFV Infrastructure Software NFVIS is related to insufficient checking of arguments passed to certain CLI commands. Exploiting this vulnerability allows an attacker to read and modify arbitrary files on the vulnerable device...

CVE-2019-10152

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file...

CVE-2019-10976

Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file .frc2. Once a user opens the file, the attacker could read arbitrary files...

Arbitrary File Reads And Writes

github.com/b3log/wide is vulnerable to many arbitrary file read and write attacks. The attacker can launch three types of attacks: 1 writing arbitrary code in the editor and running three times for read access to arbitrary files. 2 creating a symlink for a ZIP archive to trigger an arbirary file...

CVE-2019-13915

b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then place the symlink into a ZIP archive. ...

PT-2019-13474 · B3Log · B3Log Wide

Name of the Vulnerable Software and Affected Versions: b3log Wide versions prior to 1.6.0 Description: The issue allows an attacker to access arbitrary files through three types of attacks. First, an attacker can write and execute code in the editor to read arbitrary files. Second, an attacker ca...

b3log Wide Arbitrary File Read/Write Vulnerability

b3log Wide is a set of Web-based Go language integrated development environment IDE . An arbitrary file read/write vulnerability exists in versions of b3log Wide prior to 1.6.0, which can be exploited by an attacker to access arbitrary files...

The vulnerability in the Apache Thrift web server for Node.js exists due to an incorrect pathname limitation for the restricted access directory, allowing attackers to gain access to arbitrary files.

The vulnerability in the Apache Thrift web server for Node.js exists due to an incorrect pathname limitation for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain access to arbitrary files...

CVE-2019-1894

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker with administrator privileges to overwrite or read arbitrary files on the underlying operating system OS of an affected device. The vulnerability is due to improper input validation...

Cisco Enterprise NFV Infrastructure Software Arbitrary File Read/Write Vulnerability

Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. An arbitrary file read/write vulnerability exists in Cisco Enterprise NFV...