Oracle Linux 8 : grafana (ELSA-2020-4682)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4682 advisory. - apply patch for CVE-2020-13430 also to sources, not only to compiled webpack - security fix for CVE-2020-13430 - security fix for CVE-2020-13379 -...

Pre-Authorization Limited Arbitrary File Read in Confluence Server - CVE-2020-29448

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. h3. Affected versions: version 6.13.18 6.14.0 ≤ version 7.4....

Arbitrary File Read Vulnerability in Xinhoo OA Office System fi***.php File

Xinhu OA office system is an open source online office system. Xinhao OA office system fi.php file contains arbitrary file reading vulnerability. An attacker can use this vulnerability to download arbitrary files and obtain sensitive information...

PT-2023-21653 · Alt Linux · Alt Linux

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to insufficient sanitizing in the backup process, resulting in an arbitrary file read risk. By default, the capability to access th...

PT-2022-5148 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue occurs due to an input validation error when importing lesson questions, resulting in insufficient path checks. This leads to an arbitrary file read risk, allowing a remote attacke...

Arbitrary File Read in phantom-html-to-pdf

This affects the package phantom-html-to-pdf before 0.6.1. PoC js var fs = require'fs' var conversion = require"phantom-html-to-pdf"; conversion.allowLocalFilesAccess = false conversion html: "document.writewindow.location='c:/windows/win.ini'" , functionerr, pdf var output =...

GHSA-6H7F-QWQM-35PP Arbitrary File Read in phantom-html-to-pdf

This affects the package phantom-html-to-pdf before 0.6.1. PoC js var fs = require'fs' var conversion = require"phantom-html-to-pdf"; conversion.allowLocalFilesAccess = false conversion html: "document.writewindow.location='c:/windows/win.ini'" , functionerr, pdf var output =...

Arbitrary File Read

phantom-html-to-pdf is vulnerable to arbitrary file read. An attacker is able to gain access and read arbitrary files on the host by specifying the file path...

Arbitrary File Read

jsreport-chrome-pdf is vulnerable to arbitrary file read. An attacker can send malicious requests via lib/conversion.js to read arbitrary local files...

CVE-2020-7763 Arbitrary File Read

This affects the package phantom-html-to-pdf before 0.6.1...

CVE-2020-7762 Arbitrary File Read

This affects the package jsreport-chrome-pdf before 1.10.0...

Arbitrary File Read

Overview jsreport-chrome-pdf is a Affected versions of this package are vulnerable to Arbitrary File Read. An Arbitrary File Read vulnerability exists in lib/conversion.js. PoC document.writewindow.location='../../../../../etc/passwd' Remediation Upgrade jsreport-chrome-pdf to version 1.10.0 or...

Arbitrary File Read

Overview spatie/browsershot is a library for converting a webpage to an image or pdf using headless Chrome. Affected versions of this package are vulnerable to Arbitrary File Read. By specifying a URL in the file:// protocol an attacker is able to include arbitrary files in the resultant PDF. Not...

CVE-2020-27123

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerability is due to an exposed IPC function. ...

Cisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerability is due to an exposed IPC function. ...

Moderate: Red Hat Security Advisory: grafana security, bug fix, and enhancement update

An update for grafana is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

grafana: arbitrary file read via MySQL data source

Grafana has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations...

Zendo has an arbitrary file read vulnerability

Zendo is a homegrown open source project management software. Zendo suffers from an arbitrary file read vulnerability. An attacker can exploit the vulnerability to obtain sensitive information...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : AccountsService vulnerabilities (USN-4616-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4616-1 advisory. Kevin Backhouse discovered that AccountsService incorrectly dropped privileges. A local user could possibly use this issue to cau...

ALSA-2020:4682 Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. The following packages have been upgraded to a later upstream version: grafana 6.7.4. BZ1807323 Security Fixes: grafana: XSS vulnerability via a column style on the "Dashboard Table Panel...