CVE-2018-1000124

I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in importmetadata.php (line 154) via simplexml_load_string, enabling an attacker to read local files and perform SSRF. Exploitation is described as possible by posting XML in the form_import_textare...

Solaris 10 (sparc) : 119900-16

GNOME 2.6.0: GNOME libtiff - library for reading and writing TIFF. Date this patch was last updated by Sun : Nov/10/12 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

Directory Traversal

node-srv is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of sanitization when handling file paths, allowing the ../ payload to be interpreted and reading files out of the server's scope...

Selenium Server Unauthorized Access Vulnerability

Selenium is a tool for web application testing.Selenium tests run directly in the browser, just as a real user would do. Supported browsers include IE 7, 8, 9, 10, 11, Mozilla Firefox, Safari. Google Chrome, Opera, etc. An unauthorized access vulnerability exists in Selenium Server. A malicious...

Arbitrary File Read Vulnerability in Light CMS Version 1.7

Light CMS is an intelligent website building system built in PHP+MYSQL environment. Light CMS 1.7 version of the arbitrary file reading vulnerability, an attacker can exploit the vulnerability to read any file within the site to obtain sensitive information...

D-Link DIR Series Cross-Site Scripting Vulnerability (CNVD-2018-06629)

D-Link DIR-868L and others are wireless router products from AUO D-Link. A cross-site scripting vulnerability exists in the htdocs/webinc/body/bscsmssend.php file in the D-Link DIR-868L, DIR-865L, and DIR-860L. A remote attacker can exploit the vulnerability by sending a specially crafted...

D-Link DIR Series Cross-Site Scripting Vulnerability

D-Link DIR-868L and others are wireless router products from AUO D-Link. A cross-site scripting vulnerability exists in the htdocs/webinc/js/bscsmsinbox.php file in the D-Link DIR-868L, DIR-865L, and DIR-860L. A remote attacker can exploit the vulnerability by sending a specially crafted 'Treturn...

D-Link DIR Series Cross-Site Scripting Vulnerability (CNVD-2018-06630)

The D-Link DIR-868L, DIR-865L and DIR-860L are all wireless router products from AUO D-Link. A cross-site scripting vulnerability exists in the htdocs/webinc/js/advparentctrlmap.php file in the D-Link DIR-868L, DIR-865L, and DIR-860L. A remote attacker can exploit the vulnerability by sending a...

Cross site scripting

XSS vulnerability in htdocs/webinc/js/advparentctrlmap.php in D-Link DIR-868L DIR868LA1FW112b04 and previous versions, DIR-865L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and previous versions allows remote attackers to read a cookie via a crafted...

CVE-2018-6527

XSS vulnerability in htdocs/webinc/js/advparentctrlmap.php in D-Link DIR-868L DIR868LA1FW112b04 and previous versions, DIR-865L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and previous versions allows remote attackers to read a cookie via a crafted...

CVE-2018-6527

The CVE-2018-6527 issue affects D-Link DIR-868L, DIR-865L and DIR-860L routers. It is a cookie disclosure via an XSS-like flaw in htdocs/webinc/js/adv_parent_ctrl_map.php that can be triggered by a crafted deviceid parameter to soap.cgi, exposing cookie data. Root cause: inadequate protection of ...

CVE-2018-6529

The CVE-2018-6529 issue affects D-Link DIR-868L, DIR-865L, and DIR-860L routers (DIR868LA1 FW112b04 and earlier; DIR865L REVA FW1.08.B01 and earlier; DIR860LA1 FW110b04 and earlier). It is an XSS in htdocs/webinc/js/bsc_sms_inbox.php that allows remote attackers to read a cookie by sending a craf...

XSS Vulnerability in 360 Browser Reading Mode Plugin

360 Browser 360 Security Browser launched by Beijing Qihoo Technology Co. A DOMXSS vulnerability exists in the Reading Mode plugin of 360 Browser, where materialized tags can also trigger xss, leading to the execution of xss bypassing waf rules...

CVE-2017-5188

The bsworker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information...

Medtronic 2090 Carelink Programmer Directory Traversal Vulnerability

The Medtronic 2090 Carelink Programmer is used by trained personnel in hospitals and clinics to program and manage Medtronic cardiac devices. The software deployment network for the affected product contains a directory traversal vulnerability that could allow an attacker to read files on the...

CVE-2018-4880

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of...

vulners.com: [vulners.com] nginx alias_traversal

Incorrect configuration of alias could allow an attacker to read file stored outside the target folder. https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md Уязвимость только в конфигурации http, на https такого нет. Пример: http GET /static../monit/COPYING HTTP/1.1 Host:...

CVE-2018-1000028

Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in NFS server nfsd that can result in remote users reading or writing files they should not be able to via NFS. This attack appear to be exploitable via NFS...

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are caused by an operation that goes beyond the buffer boundaries in memory, allowing an attacker to trigger a service failure.

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird arise from an operation that goes beyond the buffer boundaries in memory when reading certificates from the disk. Exploiting these vulnerabilities can allow a malicious actor to cause service failures using...

Semrush: XXE in Site Audit function exposing file and directory contents

Summary: The Project Site Audit function is vulnerable to XXE when parsing sitemap.xml files. Description: The Site Audit function spiders a given website and performs analysis on the discovered pages. In order to improve website spidering the URL of a sitemap.xml file can be provided. If provide...