PT-2023-14453

Name of the Vulnerable Software and Affected Versions CRMEB version 4.4.4 Description The issue allows for the download of any file, indicating a significant security risk. There is no information provided about the estimated number of potentially affected devices worldwide or details about...

WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to Arbitrary File Download

Software 1003 Mortgage Application Type Plugin Vulnerable versions = 1.75 Fixed in 1.80 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Download CVE CVE-2022-45368 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 541a2fe842ed Credits Rodrigo Escobar...

CVE-2022-48161

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

CVE-2022-48161

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

Design/Logic Flaw

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

EasyImages 安全漏洞

EasyImages is a thin wrapper on PIL by Jakub Cieslik individual developer. It is used for exploring, visualizing and sharing images. A security vulnerability exists in EasyImages version v2.0, which stems from the presence of an arbitrary file download vulnerability that can be exploited by an...

CVE-2022-48161

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

PT-2023-15596 · Unknown · Easy Images

Name of the Vulnerable Software and Affected Versions: Easy Images version 2.0 Description: The issue allows for an arbitrary file download via the /application/down.php component. It is exploited through a crafted GET request. Recommendations: For Easy Images version 2.0, consider restricting...

CVE-2022-48161

CVE-2022-48161 affects Easy Images v2.0. An arbitrary file download vulnerability exists in the component /application/down.php, exploitable via a crafted GET request. The issue is mapped with CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base score 7.5, HIGH; network vector, no privileges, no ...

CVE-2022-48161: Files or Directories Accessible to External Parties

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

Correos Oficial <= 1.3.0.0 - Unauthenticated Arbitrary File Download

The plugin does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server. Dependency: WooCommerce plugin Use the following curl command to download the contents of the wp-config.php file: curl...

CVE-2022-48161

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

RONDS EPM 路径遍历漏洞

RONDS EPM is an application from RONDS, Inc. A path traversal vulnerability exists in RONDS EPM version 1.19.5 that stems from not properly validating the filename parameter. An attacker could use this vulnerability to download a file from a specified file path...

NVIDIA BMC 代码问题漏洞

NVIDIA BMC is an OpenBMC open software framework from NVIDIA. A security vulnerability exists in NVIDIA BMC. An attacker exploiting this vulnerability could upload and download arbitrary files under certain circumstances, resulting in a denial of service, privilege escalation, information...

CVE-2022-4298: Undefined Security Weakness

The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server...

CVE-2022-45426: Files or Directories Accessible to External Parties

Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific crafted packet to the vulnerable interface, an attacker can download arbitrary files...

CVE-2022-44016

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LMAPI/api/ConfigurationService/GetImages with an '"ImagesPath":"C:\"' value...

CVE-2022-44016

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LMAPI/api/ConfigurationService/GetImages with an '"ImagesPath":"C:\"' value...

Design/Logic Flaw

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LMAPI/api/ConfigurationService/GetImages with an '"ImagesPath":"C:\"' value...

PT-2022-27079 · Unknown · Simmeth Lieferantenmanager

Name of the Vulnerable Software and Affected Versions: Simmeth Lieferantenmanager versions prior to 5.6 Description: An issue was discovered that allows an attacker to download arbitrary files from the web server by abusing an API call to "/DS/LM API/api/ConfigurationService/GetImages" with an...