PT-2023-20929 · Sitecore · Sitecore Experience Platform

Name of the Vulnerable Software and Affected Versions: Sitecore Experience Platform versions prior to 10.2 Description: The issue allows remote attackers to download arbitrary files via a crafted command to the "download.aspx" endpoint. This is achieved by exploiting a Directory Traversal...

CVE-2023-27067

Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files from the file system.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download arbitrary files from the file system using...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files from the file system.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download arbitrary files from the file system using...

Cisco Identity Services Engine 3.x < 3.2P1 Arbitrary File Download (cisco-sa-ise-file-dwnld-Srcdnkd2)

According to its self-reported version, Cisco Identity Services is affected by a vulnerability in the web-based management interface. These allow an authenticated, remote attacker to download arbitrary files from the file system of an affected device. These vulnerabilities are due to insufficient...

CVE-2023-20087

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20077

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

Cisco Identity Services Engine 路径遍历漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An arbitrary file download vulnerability exists...

CVE-2023-20087: Path Traversal: '/absolute/pathname/here'

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20077 Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20077: Path Traversal: '/absolute/pathname/here'

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20077

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-2180 KIWIZ Invoices Certification & PDF System <= 2.1.3 - Unauthenticated Arbitrary File Download

The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization assuming they can upload a file on the server...

WordPress KIWIZ Invoices Certification & PDF System Plugin <= 2.1.3 is vulnerable to Arbitrary File Download

Software KIWIZ Invoices Certification & PDF System Type Plugin Vulnerable versions = 2.1.3 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Download CVE CVE-2023-2180 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID daccef4ee9c6 Credits WPScan Required...

CVE-2023-25508: Improper Limitation of a Pathname to a Restricted Directory

NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, and data tamperi...

KIWIZ Invoices Certification & PDF System <= 2.1.3 - Unauthenticated Arbitrary File Download

The plugin does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization assuming they can upload a file on the server To download ../../../../wp-config.php:...

CVE-2023-27755

go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...

CVE-2023-27755

go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...

CVE-2023-27755: Unrestricted Upload of File with Dangerous Type

go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...

CVE-2023-27755

go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...