Jekyll Arbitrary File Access Vulnerability

Jekyll is a static website generator. A security vulnerability exists in Jekyll version 3.6.2 and earlier, version 3.7.x through 3.7.3, and version 3.8.x through 3.8.3. An attacker can exploit the vulnerability by specifying a symbolic link in the 'include' key of the 'config.yml' file to access...

CVE-2018-17567

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "config.yml" file...

Arbitrary File Read And Write

org.apache.karaf.shell.core is vulnerable to arbitrary file read and write. A user with rights to the Karaf console is able to read or write any file on the file system, which would allow an attacker with access to the sshd service to abuse the vulnerability to read or write arbitrary files on th...

Apache Camel Mail Path Traversal Vulnerability

Apache Camel is the United States Apache Apache Software Foundation of a set of open source based on Enterprise Integration Pattern Enterprise Integration Pattern , referred to as EIP integration framework. The framework provides Enterprise Integration Pattern of Java objects POJO implementation ...

CVE-2018-16288

LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs...

Cybozu Garoon Path Traversal Vulnerability

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin boards, document management, and other functions, and supports free switching among three languages Chinese, Japanese, and English. A path traversal vulnerability...

taoCMS V2.5Beta5 has arbitrary file reading vulnerability

TAOCMS is the smallest fully functional CMS management system in China based on php+sqlite/mysql. taoCMS V2.5Beta5 has an arbitrary file reading vulnerability, which can be exploited by an attacker to read, download and edit all files of the site...

CVE-2017-9000

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An...

Design/Logic Flaw

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An...

CVE-2017-9000

CVE-2017-9000 affects ArubaOS on multiple branches (pre-6.3.1.25, pre-6.4.4.16, pre-6.5.1.9/6.5.2/6.5.3/6.5.4, and pre-8.1.0.4). It describes an unauthenticated arbitrary file access vulnerability that can be exploited by an unauthenticated attacker with network access to an Aruba Mobility Contro...

CVE-2017-9000

ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An...

USN-3730-1: LXC vulnerability

Matthias Gerstner discovered that LXC incorrectly handled the lxc-user-nic utility. A local attacker could possibly use this issue to open arbitrary files...

USN-3730-1 lxc vulnerability

Matthias Gerstner discovered that LXC incorrectly handled the lxc-user-nic utility. A local attacker could possibly use this issue to open arbitrary files...

File Inclusion Vulnerability in aitecms V1.0

Hainan Zanzan Network Technology Co., Ltd. is a network company in the industry that provides professional website construction, network service and operation technology output. aitecms V1.0 has a file inclusion vulnerability that can be exploited by attackers to access arbitrary files...

Directory Traversal

JavaServer Faces is vulnerable to directory traversal. A malicious user can access arbitrary files through loc parameters in the function ResourceManager.java:getLocalePrefix...

UBUNTU-CVE-2016-9487

EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf...

CVE-2016-9484 PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder directories and is vulnerable to path traversal

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any P...

CVE-2016-9484

The CVE-2016-9484 vulnerability in PHP FormMail Generator arises from generated PHP form code that does not properly validate user-supplied folder directories, enabling a remote unauthenticated attacker to perform path traversal and access arbitrary files on the server. The issue affects PHP form...

Dicoogle PACS 2.5.0 - Directory Traversal

Dicoogle PACS 2.5.0 - Directory Traversal Exploit Title: Dicoogle PACS 2.5.0 - Directory Traversal Date: 2018-05-25 Software Link: http://www.dicoogle.com/home Version: Dicoogle PACS 2.5.0-201712291522 Category: webapps Tested on: Windows 2012 R2 Exploit Author: Carlos Avila Contact:...

CVE-2018-14669

ClickHouse MySQL client had “LOAD DATA LOCAL INFILE” functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server. Andrey Krasichkov and Evgeny Sidorov of Yandex Information Security Team...