CVE-2019-13932

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web application requests could be manipulated, causing the the application to behave in unexpected ways for legitimate users. Successful exploitation does not require for an attacker to be authenticated. A successful attack cou...

CVE-2019-2337

CVE-2019-2337 describes a buffer-read flaw in Qualcomm’s Snapdragon hardware/firmware where EMM may read beyond the declared message length while skipping unknown IES. The issue is linked to multiple Snapdragon platforms (Auto, Compute, Consumer IoT, Industrial IoT, Mobile, Wearables) and a long ...

Microsoft Windows Media Player Information Disclosure Vulnerability (CNVD-2019-45916)

Microsoft Windows 7 SP1 and others are a series of operating systems released by Microsoft.Windows Media Player is one of these media players. An information disclosure vulnerability exists in Windows Media Player in Microsoft Windows 7 SP1, which can be exploited by an attacker to read data by...

Null pointer dereference

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the poorly named dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default...

CVE-2019-14861

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the poorly named dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default...

UBUNTU-CVE-2019-13748

Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: 2D. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

Directory Traversal

iobroker.admin is vulnerable to directory traversal. The vulnerability exists as it allows reading of files that exists outside the public folder by adding %2e%2e/ in the requested file path...

SAS Institute SAS XML Mapper XML External Entity (XXE) Vulnerability

SAS Institute SAS XML Mapper is an XML mapper from the U.S. SAS SAS Institute. The product automatically analyzes the structure of XML files and generates basic metadata. An XML External Entity XXE vulnerability exists in SAS Institute SAS XML Mapper version 9.45. The vulnerability stems from an...

CVE-2019-14678

SAS XML Mapper 9.45 has an XML External Entity XXE vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects...

Xxe

SAS XML Mapper 9.45 has an XML External Entity XXE vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects...

CVE-2019-14678

SAS XML Mapper 9.45 has an XML External Entity XXE vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects...

CVE-2019-14678

SAS XML Mapper 9.45 contains an XML External Entity (XXE) vulnerability in its XML parsing, also affecting the XMLV2 LIBNAME engine when AUTOMAP is used. The issue enables attackers to perform Local File Reading, Out Of Band File Exfiltration, Server-Side Request Forgery, and Potential Denial of ...

hw: Intel SGX information leak

A flaw was found in the implementation of SGX around the access control of protected memory. This flaw allows a local attacker of a system with SGX enabled and an affected intel GPU with the ability to execute code to interpret the contents of the SGX protected memory...

hw: Intel GPU Denial Of Service while accessing MMIO in lower power state

A flaw was found in Intel graphics hardware GPU where a local attacker with the ability to issue an ioctl could trigger a hardware level crash if MMIO registers were read while the graphics card was in a low-power state. This creates a denial of service situation and the GPU and connected display...

The vulnerability of the VideoLAN VLC media player, which arises from reading data beyond the buffer in memory, allows a hacker to cause a system failure.

The vulnerability of the VideoLAN VLC media player arises from reading data beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to cause the code to fail by using a specially created .wmv file...

Valleylab FT10 and Valleylab FX8 Trust Management Issues Vulnerability

The Medtronic Valleylab FT10 and Valleylab FX8 are both power supply devices for the medical industry from Medtronic. The Valleylab FT10 and Valleylab FX8 have a trust management issue vulnerability that can be exploited by an attacker to read files on the devices...

CVE-2009-3614

liboping 1.3.2 allows users reading arbitrary files upon the local system...

Design/Logic Flaw

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read...

Infogram: LFI through the MySQL connection

Hello team! I've found a way to read Infogram's server local files through the MySQL connection. The problem is that you're using the LOAD DATA LOCAL feature with your MySQL client. This how an attacker can easily send server's local files to her/his database. I've successfully readed the...