1309 matches found
Multiple Directory Traversal Vulnerability in ARJ
arj is an early DOS operating system under the compression format, is the famous DOS compression software arj.exe compressed file archive format. There are multiple directory traversal vulnerabilities in ARJ, which allow a remote attacker to access or read arbitrary files containing sensitive...
CVE-2014-5359
Directory traversal vulnerability in SafeNet Authentication Service SAS Outlook Web Access Agent formerly CRYPTOCard before 1.03.30109 allows remote attackers to read arbitrary files via a .. dot dot in the GetFile parameter to owa/owa...
cups: allows local users to read arbitrary files via a symlink attack
It was discovered that CUPS allowed certain users to create symbolic links in certain directories under /var/cache/cups/. A local user with the 'lp' group privileges could use this flaw to read the contents of arbitrary files on the system or, potentially, escalate their privileges on the system...
apache-poi: XML eXternal Entity (XXE) flaw
It was found that Apache POI would resolve entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to read files accessible to the user running the application server, and potentially perform more advanced XML External Entity...
PT-2014-6184 · Bmc · Bmc Track-It!
Name of the Vulnerable Software and Affected Versions: BMC Track-It! version 11.3.0.355 Description: The issue allows remote authenticated users to read arbitrary files by visiting the "TrackItWeb/Attachment" page. Recommendations: For version 11.3.0.355, consider restricting access to the...
CVE-2014-3914
CVE-2014-3914 affects Rocket Servergraph 1.2 Admin Center, with directory traversal in the fileRequestor servlet (and related fileRequestServlet/userRequest servlet) allowing actions such as writeDataFile, run, runClear, readDataFile, del, and save_server_groups to be abused via crafted query/bod...
UBUNTU-CVE-2014-5029
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language0 set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537...
UBUNTU-CVE-2014-5020
The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field...
PicketLink: XXE via insecure DocumentBuilderFactory usage
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the...
PicketLink: XXE via insecure DocumentBuilderFactory usage
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the...
simple web-server 1.2 - Directory Traversal
No description provided by source. ------------------------------------------------------------------------ Software................Simple web-server 1.2 Vulnerability...........Directory Traversal Threat Level............Serious 3/5 Download................http://www.storecalc.com Discovery...
Taboada Macronews <= 1.0 - SQLi Exploit
No description provided by source. ?php / Exploit Title: Taboada Macronews = 1.0 SQLi Exploit Date: 03rd January 2013 Exploit Author: WhiteCollarGroup Software Link: http://www.scriptbrasil.com.br/download/codigo/7144/ Version: 1.0 Google Dork: intext:Powered by: joaotaboada.com Usage: php...
yawcam 0.2.5 - Directory Traversal vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13295/info Yawcam is prone to a directory traversal vulnerability that could allow attackers to read files outside the Web root. GET ................\windows\system.ini HTTP/1.0 GET...
ElasticSearch Remote Code Execution Exploit
Exploit for multiple platform in category web applications body padding-top: 50px; .starter-template padding: 40px 15px; text-align: center; function esinject var readfile; var writefile; readfile = functionfilename return "import java.util.;\nimport java.io.;\nnew Scannernew File"" + filename +...
UBUNTU-CVE-2013-6889
GNU Rush 1.7 does not properly drop privileges, which allows local users to read arbitrary files via the --lint option...
PT-2014-4538 · Cisco · Cisco Asa
Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Description: The issue allows remote authenticated users to read files by sending a crafted URL to the HTTP server, potentially accessing sensitive information suc...
UBUNTU-CVE-2014-1297
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access...
PT-2014-4357 · Videowhisper · Videowhisper Live Streaming Integration
Name of the Vulnerable Software and Affected Versions: VideoWhisper Live Streaming Integration plugin versions prior to 4.29.5 Description: The issue allows remote attackers to read or delete arbitrary files due to directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration...
CVE-2013-6708
Cisco Cloud Portal 9.4 allows remote attackers to read files of unspecified types via a direct request, aka Bug IDs CSCuj08426 and CSCui60889...
CVE-2013-5598
PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object...