CVE-2022-32270

In Real Player 20.0.7.309 and 20.0.8.310, external::Import allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder DLL planting could also occur...

Directory traversal

In Real Player 20.0.7.309 and 20.0.8.310, external::Import allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder DLL planting could also occur...

CVE-2022-32270

CVE-2022-32270 affects RealNetworks RealPlayer versions 20.0.7.309 and 20.0.8.310. The flaw arises in external::Import(), which permits downloading arbitrary file types and directory traversal, enabling remote code execution. Root cause is facilitate­ment of DLL planting or executables in the sta...

CVE-2022-32270

In Real Player 20.0.7.309 and 20.0.8.310, external::Import allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder DLL planting could also occur...

RealNetworks Real Player 路径遍历漏洞

RealNetworks Real Player is a cross-platform player from RealNetworks, Inc. for enjoying a wide variety of online audio and video material. A security vulnerability exists in Real Player versions 20.0.7.309 and 20.0.8.310, which stems from external::Import allows downloading of arbitrary file typ...

CVE-2021-41714

In Tipask 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage...

Tipask 安全漏洞

Tipask is an open-source PHP question and answer system by the individual developer Song Dengfeng sdfsky in China. A security vulnerability exists in Tipask versions prior to 3.5.9, which is caused by a user inputting a path parameter that is not validated when downloading attachments. An attacke...

CVE-2021-41714: Download of Code Without Integrity Check

In Tipask 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage...

CVE-2021-26630

Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function...

Handysoft Groupware 输入验证错误漏洞

Handysoft Handy Groupware is an office collaboration solution from Handysoft Korea. The product supports features such as meeting management, attendance management, and human resource assessment. A security vulnerability exists in Handysoft Groupware for Windows, which originates from incorrect...

CVE-2022-30058

Shopwind =v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at \backend\controllers\DbController.php...

CVE-2022-30058

Shopwind =v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at \backend\controllers\DbController.php...

CVE-2022-30058

Shopwind =v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at \backend\controllers\DbController.php...

CVE-2022-30058

CVE-2022-30058 affects Shopwind

CVE-2022-30058

Shopwind =v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at \backend\controllers\DbController.php...

Arbitrary File Download Vulnerability in Centron View Cloud Terminal Security Management System

CentronView Terminal Security Management System is an enterprise-level network anti-virus system developed by Beijing CentronView Information Technology Co. There is an arbitrary file download vulnerability in CentronView Cloud Terminal Security Management System, which can be exploited by...

PT-2022-19993

Name of the Vulnerable Software and Affected Versions Shopwind versions prior to 3.4.3 Description The issue is related to an Arbitrary File Download vulnerability. It can be exploited via the neirong parameter at the backendcontrollersDbController.php file. Recommendations For versions prior to...

CVE-2022-30058: Improper Limitation of a Pathname to a Restricted Directory

Shopwind =v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at \backend\controllers\DbController.php...

CVE-2021-43930: Improper Limitation of a Pathname to a Restricted Directory

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system...

CVE-2022-1119

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the /includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in...