Arbitrary File Read Vulnerability in MTS Transcoding Server of Suzhou Kedar Technology Co.

Ltd. is a provider of video and security products and solutions, dedicated to video conferencing, video surveillance and video application solutions to help various government and enterprise customers to solve visual communication and management challenges. An arbitrary file read vulnerability...

Arbitrary File Read

electron is vulnerable to arbitrary file read. An attacker is able to read local files by defining unsafe window options on a child window that is opened using window.open...

CVE-2020-4075

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling event.preventDefault on all new-window events where the url or options is not...

CVE-2020-4075 Arbitrary file read via window-open IPC in Electron

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling event.preventDefault on all new-window events where the url or options is not...

GHSA-F9MQ-JPH6-9MHM Arbitrary file read via window-open IPC in Electron

Impact The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open. Workarounds Ensure you are calling event.preventDefault on all new-window events where the url or options is not something you expect. Fixed Versions 9.0.0-beta.21...

CVE-2020-5366

Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files...

Appear TV XC5000 and XC5100 Arbitrary File Read (CVE-2018-7539)

A vulnerability exists in Appeartv xc5000 firmware 3.26.217. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

CVE-2020-5907

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell tmsh may be able to conduct arbitrary file read/writes via the built-in sftp functionality...

GHSA-RGH3-987H-WPMW XML External Entity Injection in XStream

Multiple XML external entity XXE vulnerabilities in the 1 Dom4JDriver, 2 DomDriver, 3 JDomDriver, 4 JDom2Driver, 5 SjsxpDriver, 6 StandardStaxDriver, and 7 WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document...

Weiphp5.0beta A***.php has an arbitrary file read vulnerability in Shenzhen Yuanmeng Cloud Technology Co.

WeiPHP is an open source WeChat public platform development framework, can easily build a personal WeChat public account operation platform. Shenzhen Yuanmeng Cloud Technology Co., Ltd Weiphp5.0beta A.php There is an arbitrary file reading vulnerability, which can be exploited by attackers to...

Phpyun Talent Management System v5.0 has an arbitrary file read vulnerability

phpyun is a talent management system. Phpyun Talent Management System v5.0 has an arbitrary file reading vulnerability that can be exploited by attackers to read arbitrary files...

Directory Traversal

Overview rollup-plugin-server is a rollup plugin to serve the bundle. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function. PoC by JHU System Security Lab 1. Create a serv...

Directory Traversal

Overview marked-tree is a markdown viewer for viewing markdown within a development environment. Affected versions of this package are vulnerable to Directory Traversal. There is no path sanitization in the path provided at fs.readFile in index.js. PoC by JHU System Security Lab 1. Start the serv...

USN-4315-2 apport vulnerabilities

USN-4315-1 fixed several vulnerabilities in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Maximilien Bourgeteau discovered that the Apport lock file was created with insecure permissions. This could allow a local attacker to escalate their...

Arbitrary File Read Vulnerability in Extreme CMS

Extreme CMS is an open source PHPCMS web content management system. Extreme CMS has an arbitrary file read vulnerability that can be exploited by attackers to obtain sensitive information...

Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371

A flaw was found in Eclipse Mojarra before version 2.3.14, where it is vulnerable to a path traversal flaw via the loc parameter or the con parameter. An attacker could exploit this flaw to read arbitrary files...

Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371

A flaw was found in Eclipse Mojarra before version 2.3.14, where it is vulnerable to a path traversal flaw via the loc parameter or the con parameter. An attacker could exploit this flaw to read arbitrary files...

EyouCms has an arbitrary file read vulnerability

EyouCms is a free + open source enterprise content management system developed on the core of TP5.0 framework. EyouCms has an arbitrary file reading vulnerability, attackers can use this vulnerability to obtain sensitive information...

SnapGear Management Console SG560 3.1.5 - Arbitrary File Read Vulnerability

Exploit for hardware platform in category web applications Title: Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read Author:LiquidWorm Vendor: http://www.securecomputing.com CVE: N/A Secure Computing SnapGear Management Console SG560 v3.1.5 Arbitrary File Read/Write...

Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read

Title: Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read Author:LiquidWorm Date: 2020-06-04 Vendor: http://www.securecomputing.com CVE: N/A Secure Computing SnapGear Management Console SG560 v3.1.5 Arbitrary File Read/Write Vendor: Secure Computing Corp. Product web...