Arbitrary File Download Vulnerability in HRSALE Management System

HRSALE is a human resource management system. An arbitrary file download vulnerability exists in the HRSALE management system. An attacker can exploit the vulnerability to download arbitrary sensitive files...

Guangzhou red sail technology limited company red sail ioffice hospital OA exists arbitrary file download vulnerability

Guangzhou Redfan Technology Co., Ltd. business scope includes computer room maintenance services, information technology consulting services, etc. Guangzhou red sail technology limited company red sail ioffice hospital OA exists arbitrary file download vulnerability, attackers can use the...

IBM InfoSphere Guardium Directory Traversal Vulnerability

InfoSphere Guardium is an enterprise information database auditing and protection solution. A directory traversal vulnerability exists in IBM InfoSphere Guardium 8.0, 8.01, and 8.2, which allows an attacker to send a malicious URL request to download arbitrary files on the system...

Brave Software: Arbitrary file download due to bad handling of Redirects in WebTorrent

Summary: Previously I reported 963155 how an attacker can trick user into downloading malicious files using ".save torrent" feature, In this report I am going to reproduce the same behavior but by abusing a different feature. Description While I was testing webtorrent on brave I noticed that...

CVE-2012-3337: Improper Limitation of a Pathname to a Restricted Directory

IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to download arbitrary files on the system. IBM X-Force ID: 78284...

Arbitrary File Download Vulnerability in shopxo

ShopXO is an open source enterprise-level open source e-commerce system. shopxo has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2020-7831

A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able to use startup menu directory via directory traversal for automatic execution. The victim user need to reboot, however...

CVE-2020-7831: Download of Code Without Integrity Check

A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. The attacker is able to use startup menu directory via directory traversal for automatic execution. The victim user need to reboot, however...

TIBCO Software Data Virtualization Arbitrary File Download Vulnerability

TIBCO Software Data Virtualization is an enterprise data virtualization solution. An arbitrary file download vulnerability exists in the TIBCO Data Virtualization Server component of TIBCO Software Data Virtualization, which can be exploited by a remote attacker to submit a special request to...

Brave Software: Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSS

Summary: An attacker can use the "Save .torrent file" option in WebTorrent to smuggle malicious files onto the client's machine. Description Brave allows users to download the ".torrent" via WebTorrent. WebTorrent decides whether a file is torrent or not based on the following headers...

CVE-2020-9415

The TIBCO Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains a vulnerability that theoretically allows a malicious authenticated user to download any arbitrary file from the affected system. The user...

CVE-2020-9415: Undefined Security Weakness

The TIBCO Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains a vulnerability that theoretically allows a malicious authenticated user to download any arbitrary file from the affected system. The user...

PT-2020-20644

Name of the Vulnerable Software and Affected Versions TIBCO Data Virtualization versions 7.0.8 and below TIBCO Data Virtualization versions 8.0.0, 8.1.0, 8.1.1, and 8.2.0 TIBCO Data Virtualization for AWS Marketplace versions 8.2.0 and below Description The issue allows a malicious authenticated...

Arbitrary File Download Vulnerability in Heartland OA

Heartland OA is a multi-functional and intelligent office application. An arbitrary file download vulnerability exists in Heartland OA. An attacker can exploit the vulnerability to download arbitrary files...

CVE-2020-7817

MyBrowserPlus downloads the files needed to run the program through the setup file Setup.inf. At this time, there is a vulnerability in downloading arbitrary files due to insufficient integrity verification of the files...

CVE-2020-7817

CVE-2020-7817 affects MyBrowserPlus. The issue arises from a vulnerability during setup file handling, where files downloaded for running the program through Setup.inf lack sufficient integrity verification, allowing potential arbitrary file downloads. Connected documents do not provide product/v...

WeLive online customer service system suffers from arbitrary file download vulnerability

WeLive Online Customer Service System is an online online customer service system. WeLive Online Customer Service System has an arbitrary file download vulnerability. An attacker can use this vulnerability to download arbitrary files from the server and obtain sensitive information...

PT-2020-19814

Name of the Vulnerable Software and Affected Versions MyBrowserPlus affected versions not specified Description The issue arises during the download of necessary files for the program through the setup file Setup.inf, where there is a lack of sufficient integrity verification of the files, allowi...

CVE-2020-7817: Download of Code Without Integrity Check

MyBrowserPlus downloads the files needed to run the program through the setup file Setup.inf. At this time, there is a vulnerability in downloading arbitrary files due to insufficient integrity verification of the files...

WordPress Product Input Fields for WooCommerce plugin <= 1.2.6 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by NinTechNet in WordPress Product Input Fields for WooCommerce plugin versions = 1.2.6. Solution Update the WordPress Product Input Fields for WooCommerce plugin to the latest available version at least 1.2.7...