5849 matches found
Xxe
Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...
KLA10643 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, conduct CSS attack, gain privileges or execute arbitrary code. Below is a complete list of vulnerabilities 1. Several...
UBUNTU-CVE-2015-3187
The svnrepostracenodelocations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path...
Design/Logic Flaw
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file...
CVE-2015-1009
Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file...
wireshark security, bug fix, and enhancement update
1.8.10-17.0.2 - Fix ocfs2 dissector John Haxby orabug 21505640 1.8.10-17.0.1.el6 - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect 1.8.10-17 - security patches - Resolves: CVE-2015-2189 CVE-2015-2191 1.8.10-16 - security patches - Resolves: CVE-2014-8710 CVE-2014-8711...
CVE-2015-1883
IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure...
Oracle E-Business Suite – XXE injection vulnerability
Application: Oracle E-Business Suite Vendor: Oracle Versions Affected: Oracle E-Business Suite 12.1.3, probably others Bugs: XXE injection Reported: 17.07.2015 Vendor response: 24.07.2015 Date of Public Advisory: 19.01.2016 Reference: Oracle CPU Jan 2016 Author: Nikita Kelesis, Ivan Chalykin,...
Microsoft Internet Explorer Information Disclosure Vulnerability (CNVD-2015-04628)
Microsoft Internet Explorer is a popular web browser introduced by Microsoft and bundled with the Windows operating system. An information disclosure vulnerability exists in versions 9 through 11 of Microsoft Internet Explorer, which allows remote attackers to exploit the vulnerability to read...
reading-honda.co.uk XSS vulnerability
Vulnerable URL: http://www.reading-honda.co.uk/interstitial.asp?p=%22%3E%3Cscript%3Ealert%28/XSSPOSED/%29%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 12:11 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclose...
PT-2015-4368
Name of the Vulnerable Software and Affected Versions Slider Revolution revslider plugin versions prior to 4.2 for WordPress Description The issue allows remote attackers to read arbitrary files by exploiting a directory traversal vulnerability in the Slider Revolution plugin. This is achieved by...
CVE-2015-1851
OpenStack Cinder before 2014.1.5 icehouse, 2014.2.x before 2014.2.4 juno, and 2015.1.x before 2015.1.1 kilo allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command...
[SECURITY] [DSA 3292-1] cinder security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3292-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 19, 2015 https://www.debian.org/security/faq -...
CVE-2015-3010
ceph-deploy before 1.5.23 uses weak permissions 644 for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file...
CVE-2015-2953
CVE-2015-2953 affects Igreks MilkyStep Light 0.94 and earlier and MilkyStep Professional 1.82 and earlier. The user-information management functionality allows remote attackers to bypass access restrictions and read files via unspecified vectors. This vulnerability is corroborated by CNVD/NVD ent...
Directory traversal
Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to 1 read arbitrary files via a .. dot dot in the fileName parameter to getGfiUpgradeFile or 2 cause a denial of service CPU and memory consumption via a .. dot dot in the fileName parameter to...
IBM Marketing Operations Catalog Traversal Vulnerability
IBM Marketing Operations formerly known as IBM Unica Marketing Operations is a suite of marketing management software from the American company IBM. The software supports streamlining of production processes, tracking of budgets and expenditures, and improved teamwork. A directory traversal...
Adobe Flash Player SWF File Handling Local Information Disclosure Vulnerability
Adobe Flash Player is a cross-platform, browser-based multimedia player product from the American company Adobe. Adobe Flash Player suffers from an information disclosure vulnerability in the handling of swf files, which can be exploited by remote attackers to construct malicious content and tric...
CVE-2015-0758
Cisco Unified MeetingPlace 8.6(1.9) is affected by CVE-2015-0758 via an XML External Entity (XXE) processing flaw that allows authenticated, remote attackers to read arbitrary files from the server. The vulnerability stems from improper handling of XML entities in the web-based user interface, as...