Arbitrary File Read Vulnerability in the Basename Function of the SDCMS errorcontroller.php Page

SDcms is a content management system developed by Suzhou Fireworks Network Technology Co. SDCMS errorcontroller.php page basename function has an arbitrary file reading vulnerability, an attacker can use the vulnerability to read arbitrary files to obtain sensitive information...

Zyxel P-660HW-61 Firmware < 3.40(PE.11)C0 Router - Local File Inclusion

Exploit Title: Zyxel P-660HW-61 3.40PE.11C0 - Local File Inclusion Date: 2-05-2017 Exploit Author: ReverseBrain Contact: https://www.twitter.com/ReverseBrain Vendor Homepage: https://www.zyxel.com Software Link: ftp://ftp.zyxel.com/P-660HW-61/firmware/P-660HW-613.40PE.11C0.zip Version: 3.40PE.11C...

CVE-2016-10350

The archivereadformatcabreadheader function in archivereadsupportformatcab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted file...

Directory traversal

Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors...

Reading Analytics and Privacy

Interesting paper: "The rise of reading analytics and the emerging calculus of reading privacy in the digital world," by Clifford Lynch: Abstract: This paper studies emerging technologies for tracking reading behaviors "reading analytics" and their implications for reader privacy, attempting to...

Design/Logic Flaw

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page...

CVE-2017-3545

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware subcomponent: Blob Server. Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP ...

CVE-2017-3501

Vulnerability in the Primavera Unifier component of Oracle Primavera Products Suite subcomponent: Platform. Supported versions that are affected are 9.13, 9.14, 10.0, 10.1, 15.1 and 15.2. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2017-3288

Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications subcomponent: Unit Trust. Supported versions that are affected are 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.1.0, 12.2.0 and 12.3.0. Easily "exploitable" vulnerability allows low privileged attack...

Code injection

Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 Galaxy S6 devices allows attackers to read sent e-mail messages, aka SVE-2015-5081...

Adobe Reader DC Collab shareFile Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2017-7646

SolarWinds Log & Event Manager (LEM) prior to 6.3.1 Hotfix 4 allows an authenticated user to browse the server filesystem and read arbitrary files. Risk details are not expanded beyond this description in the provided documents. Remediation: upgrade to 6.3.1 Hotfix 4 or newer where indicated.

CVE-2015-8276

LVRTC eParakstitajs 3.0 1.3.0 and edoc-libraries-2.5.401 allow attackers to read arbitrary files via crafted EDOC files...

CVE-2015-8276

LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 contain an information disclosure vulnerability that allows an attacker to read arbitrary files via specially crafted EDOC files. The issue is described across connected sources (CNVD-2017-16012, NVD CVE-2015-8276). The root cause is inf...

CVE-2014-2960

This CVE concerns Vision Critical before 2014-05-30, where an information-disclosure vulnerability allowed reading arbitrary files via unspecified vectors, demonstrated with image and configuration files. Affected product: Vision Critical cloud-based intelligent user management platform (pre-2014...

Huawei Files Plaintext Storage Password Vulnerability

Huawei Files is a file management APP software on cell phones from Huawei China. A plaintext storage password vulnerability exists in Huawei Files 7.1.0.308 and earlier versions. An attacker can read the plaintext password information of a user's confidential cabinet by spoofing the related...

CVE-2017-0360

fileopen in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242...

CVE-2017-7407

The ourWriteOut function in toolwriteout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a...

Design/Logic Flaw

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to read passwords via a direct request to the x.asp page...

Apple iOS Pasteboard Component Key Encryption Vulnerability

Apple iOS is an operating system for mobile devices developed by Apple Inc. Pasteboard is a secure and standardized mechanism for exchanging data within and between applications. A security vulnerability exists in the Pasteboard component of Apple iOS versions prior to 10.3. An attacker could...