CVE-2019-17662

ThinVNC 1.0b1 is vulnerable to an arbitrary file read via a ../../ThinVnc.ini directory traversal, allowing an attacker to read the password file and bypass authentication even when authentication is enabled. The root cause is a directory traversal flaw that exposes the authentication file in cle...

CVE-2019-17662

ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a...

CVE-2019-10436

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...

CVE-2019-10436

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...

Design/Logic Flaw

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master...

CVE-2019-10436

The CVE-2019-10436 issue affects Jenkins Google OAuth Credentials Plugin up to version 0.9. The vulnerability allows attackers who can configure jobs and credentials in Jenkins to read arbitrary files on the Jenkins master, due to an improper access control path. Public details consistently descr...

PT-2019-11830 · Jenkins · Jenkins Google Oauth Credentials Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Google OAuth Credentials Plugin version 0.9 and earlier Description: The issue allows attackers who can configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master due to an arbitrary file read...

cPanel Injection Vulnerability (CNVD-2019-36138)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An injection vulnerability exists in cPanel versions prior to 11.54.0.4. The vulnerability stems from a lack of proper validation...

cPanel Access Control Error Vulnerability (CNVD-2019-36148)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An Access Control Error vulnerability exists in cPanel versions prior to 11.54.0.4. The vulnerability stems from a network system...

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files...

Arbitrary File Read Vulnerability in Sailsoft FineReport

FineReport is a simple, efficient and intelligent reporting tool to quickly build an enterprise-class Web reporting platform. An arbitrary file read vulnerability exists in FineReport, which can be exploited by attackers to obtain sensitive information...

Arbitrary File Read in html-pdf

All versions of html-pdf are vulnerable to Arbitrary File Read. The package fails to sanitize the HTML input, allowing attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. Input with an XHR request such as...

GHSA-X4W5-R546-X9QH Arbitrary File Read in html-pdf

All versions of html-pdf are vulnerable to Arbitrary File Read. The package fails to sanitize the HTML input, allowing attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. Input with an XHR request such as...

[SECURITY] [DSA 4542-1] jackson-databind security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4542-1 [email protected] https://www.debian.org/security/ Sebastien Delafond October 06, 2019 https://www.debian.org/security/faq -...

Arbitrary File Read Vulnerability in HongCMS

HongCMS is an open source lightweight content management system CMS. An arbitrary file read vulnerability exists in HongCMS. An attacker can exploit this vulnerability to obtain sensitive information...

Arbitrary File Read

github.com/opencontainers/runc is vulnerable to arbitrary file read. The vulnerability exists as the AppAmor restrictions can be bypassed due to incorrect mount targets check, allowing a malicious Docker image to be mounted over a /proc directory...

Arbitrary File Read Vulnerability in UsualToolCMS

UsualToolCMS is a content management system and rapid site building framework. Using template separation technology, it supports the creation of multiple application platforms. Has an independent template language and API model , rich plug-ins, easy to use. Supports secondary development, rich...

Arbitrary File Read Vulnerability in Zendo Project Management System

Zendo project management system developed by Qingdao Easoft Tianchuang Network Technology Co., Ltd, domestic open source project management software. It integrates product management, project management, quality management, document management, organizational management and transaction management...

Design/Logic Flaw

An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine VM to enable Android apps to run on Windows or MacOS. Bug is in a local arbitrary file read through a system service call. The impacted method...

CVE-2019-14220

An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine VM to enable Android apps to run on Windows or MacOS. Bug is in a local arbitrary file read through a system service call. The impacted method...