CVE-2020-15026: Improper Limitation of a Pathname to a Restricted Directory

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

Arbitrary File Download Vulnerability in Student Work Management Information System of Zhengfang Software Co.

The positive student work management information system, making full use of the human resources of the student work management department, through informationization, digitization, networked office on the students' learning, life, thinking and other aspects of the comprehensive management, to sol...

Shenzhen Police Wing Intelligent Technology Co., Ltd. website building system has arbitrary file download vulnerability

Shenzhen Police Wings Intelligent Technology Co., Ltd. is a leading enterprise in China's law enforcement recorder industry, focusing on providing law enforcement departments with law enforcement recorders as the core, including the Police Wings series of intelligent law enforcement equipment, th...

Arbitrary File Download Vulnerability in Website Building System of Beijing Zhongjin Yunchuang Software Co.

Ltd. is a company that has the ability to implement and develop traditional ERP, as well as experience in mobile Internet applications. There is an arbitrary file download vulnerability in the website building system of Beijing Zhongjin Yunchuang Software Co., Ltd, which can be exploited by...

Raonwiz DEXT5 Editor Arbitrary File Download Vulnerability

Raonwiz DEXT5 Editor is an HTML-based Web editor from the Korean company Raonwiz. A security vulnerability exists in the handler/uploadhandler.jsp file in Raonwiz DEXT5 Editor 3.5.1402961 and earlier versions. An attacker can exploit this vulnerability to download arbitrary files with the help of...

CVE-2020-13894

handler/uploadhandler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field...

CVE-2020-13894

handler/uploadhandler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field...

Design/Logic Flaw

handler/uploadhandler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field...

CVE-2020-13894

handler/uploadhandler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field...

CVE-2020-13894: Incorrect Default Permissions

handler/uploadhandler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field...

CVE-2020-7812

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC...

CVE-2020-7812

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC...

Code injection

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC...

CVE-2020-7812

CVE-2020-7812 affects Kaoni ezHTTPTrans (Ezhttptrans.ocx) ActiveX Control in versions ≤ 1.0.0.70. The vulnerability grants a remote attacker the ability to download arbitrary files by manipulating arguments to the ActiveX method, and can be leveraged for code execution by rebooting the victim’s P...

PT-2020-19809

Name of the Vulnerable Software and Affected Versions Kaoni ezHTTPTrans versions 1.0.0.70 and prior Description The issue allows a remote attacker to download arbitrary files by setting specific arguments to an ActiveX method, potentially leading to code execution if the victim's PC is rebooted...

CVE-2020-7812: Download of Code Without Integrity Check

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC...

IBM Data Risk Manager Vulnerabilities

Problem IBM customers running IBM Data Risk Manager version 2.0.1 and greater are advised to upgrade to the latest version of the product. IBM has provided a fix for a number of reported issues. See the Security Bulletin referenced below for details. Symptom Multiple vulnerabilities were reported...

CVE-2020-7813

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execute arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution...

CVE-2020-7813: Download of Code Without Integrity Check

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execute arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution...

Arbitrary File Download Vulnerability in Website Management System of Hangzhou Viking Club Network Technology Co.

Hangzhou Vickers Club Network Technology Co., Ltd. is a website builder. Hangzhou Vickers Club Network Technology Co., Ltd. website builder management system suffers from an arbitrary file download vulnerability, which can be exploited by an attacker to download arbitrary files...