3252 matches found
CVE-2019-16986: Improper Limitation of a Pathname to a Restricted Directory
In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. resources\securedownload.php is also affected...
CVE-2019-16990: Improper Limitation of a Pathname to a Restricted Directory
In FusionPBX up to v4.5.7, the file app/musiconhold/musiconhold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname base64 encoded and allows a download of it...
PHPOK has an arbitrary file download vulnerability
PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. PHPOK arbitrary file download vulnerability, attackers can use the vulnerability of any read, download files, access to sensitive information...
CVE-2019-13343
Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not...
Path traversal
Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not...
CVE-2019-13343
CVE-2019-13343 affects Butor Portal prior to 1.0.27 via a path traversal vulnerability in WhiteLabelingServlet. The t parameter is not properly sanitized, allowing a pre-authentication arbitrary file download by constructing a path like /wl?t=../../...&h=. Impact is potential exposure of server f...
CVE-2019-13343: Improper Limitation of a Pathname to a Restricted Directory
Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not...
Arbitrary file download vulnerability in the ba***.cl***.php file of the Seven Little Bears repository system
Seven bears library system a similar Baidu library online document preview, selling system. A vulnerability exists in the ba.cl.php file of the Seven Little Bears library system, which can be exploited by an attacker to obtain sensitive information. An attacker can exploit the vulnerability to...
Directory Traversal and Arbitrary File Download Vulnerabilities in MayiCMS (Ant Classification Information System)
MayiCMS Ant Classified Information System is a php mysql based website builder. Ant Classifieds Information System suffers from directory traversal and arbitrary file download vulnerabilities. An attacker can obtain sensitive information by traversing the directory and downloading website source...
Arbitrary File Download Vulnerability in Guojiz
Guojiz is a light community system based on layui front-end framework and thinkphp. Guojiz has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...
Arbitrary File Download Vulnerability in RGCMS
RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS arbitrary file download vulnerability, an attacker can use the vulnerability to read any file in th...
PT-2019-7073
Name of the Vulnerable Software and Affected Versions Antioch theme for WordPress versions through 2014-09-07 Description The issue allows arbitrary file downloads via the file parameter to "lib/scripts/download.php". This enables unauthorized access to files on the system. Recommendations For...
CVE-2014-10397: Improper Limitation of a Pathname to a Restricted Directory
The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php...
CVE-2014-10396: Improper Limitation of a Pathname to a Restricted Directory
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php...
PT-2019-7072
Name of the Vulnerable Software and Affected Versions Epic theme for WordPress versions through 2014-09-07 Description The issue allows arbitrary file downloads via the file parameter to the "includes/download.php" endpoint. This could potentially lead to unauthorized access to sensitive files...
OpenEMR Path Traversal Vulnerability
OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A path traversal vulnerability exists in the 'fileName' parameter of the...
Arbitrary File Download Vulnerability in Mobile Office Portal KK System
BlueLine is a large-platform OA service provider and knowledge management solution provider, a national high-tech enterprise engaged in knowledge-based consulting, software development, implementation and technical services for organizations. An arbitrary file download vulnerability exists in the...
CVE-2019-13408
A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication...
CVE-2019-3967
CVE-2019-3967 affects OpenEMR 5.0.1 and earlier, where the patient file download interface contains a directory traversal flaw allowing authenticated attackers to download arbitrary files from the host system. The connected Red Hat and CNVD entries corroborate the affected product/version and the...
