Design/Logic Flaw

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

CVE-2022-2222

CVE-2022-2222 affects the WordPress Download Monitor plugin. Versions prior to 4.5.91 fail to constrain downloaded files to the blog directory, enabling high-privilege users (e.g., admins) to download sensitive files such as wp-config.php or /etc/passwd. The issue is described across multiple sou...

CVE-2022-2222 Download Monitor < 4.5.91 - Admin+ Arbitrary File Download

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

PT-2022-15295

Name of the Vulnerable Software and Affected Versions Download Monitor WordPress plugin versions prior to 4.5.91 Description The issue allows high privilege users, such as administrators, to download sensitive files like wp-config.php or /etc/passwd, even in hardened environments or multisite...

WordPress plugin Download Monitor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file download...

CVE-2022-2222: Files or Directories Accessible to External Parties

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

WordPress Download Monitor plugin <= 4.5.9 - Authenticated Arbitrary File Download vulnerability

Authenticated Arbitrary File Download vulnerability discovered by Thiago Martins, Jorge Buzeti, Leandro Inacio, Lucas de Souza, Matheus Oliveira, Filipe Baptistella, Leonardo Paiva, Jose Thomaz, Joao Maciel, Vinicius Pereira, Geovanni Campos, Hudson Nowak, Guilherme Acerbi in WordPress Download...

MAL-2022-1531 Malicious code in bfx-facs-monitor-tx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f6ae964cb0d1bdfa408ab9a93d26dae4619ba81e1286f943e4c2f6972eb73454 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bfx-facs-monitor-tx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f6ae964cb0d1bdfa408ab9a93d26dae4619ba81e1286f943e4c2f6972eb73454 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8f7862810808843fa7ccd1ffa5156d35c5658c815a336338830de1376acc197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5289 Malicious code in perf-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8f7862810808843fa7ccd1ffa5156d35c5658c815a336338830de1376acc197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4428f5bd869858addd49edce49f8d71f8fc48bd69ab3605e79148a945adddb8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @azure-tests/perf-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d981d0c3bc3f93b7f2392e2029a93af9784e57dcdc6043ac18ff97dac615b16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-107 Malicious code in @azure-tests/perf-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d981d0c3bc3f93b7f2392e2029a93af9784e57dcdc6043ac18ff97dac615b16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-monitor-opentelemetry-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4105e451e06ab909d8a5420349c767fec791355572db7e3696eb80c244fb050 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1358 Malicious code in azure-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6409892ee45f80a5b5f76cf05c31159bfe504375ae8e0f7ddf5a8b56bf3d566c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1357 Malicious code in azure-monitor-opentelemetry-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4105e451e06ab909d8a5420349c767fec791355572db7e3696eb80c244fb050 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6409892ee45f80a5b5f76cf05c31159bfe504375ae8e0f7ddf5a8b56bf3d566c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4689 Malicious code in monitor-opentelemetry-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 729620b347fffdb19db80ab7389b2228d0b739d11d68fc8bed393e29ed9dd745 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in monitor-opentelemetry-exporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 729620b347fffdb19db80ab7389b2228d0b739d11d68fc8bed393e29ed9dd745 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...