3253 matches found
Arbitrary File Download and Code Execution Vulnerability in Mycncartt v2.0.0.3
MyCnCart MCC for short is a free, open source B2C, B2B e-commerce platform system developed for the Chinese mainland market. Mycncartt v2.0.0.3 suffers from an arbitrary file download and code execution vulnerability, as the program does not make reasonable judgments and filters on the download...
CylancePROTECT 2.0.x < 2.0.1480 SSL Validation (Cy2008-002)
The version of CylancePROTECT installed on the remote host is a version 2.0.x prior to 2.0.1480. It is, therefore, affected by an SSL validation flaw that can allow an attacker to cause an arbitrary file download. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109596...
CylancePROTECT 2.0.x < 2.0.1480 SSL Validation (Cy2008-002) (macOS)
The version of CylancePROTECT installed on the remote MacOS/MacOSX host is 2.0.x prior to 2.0.1480. It is, therefore, affected by an SSL validation flaw that can allow an attacker to cause an arbitrary file download. C Tenable Network Security, Inc. include"compat.inc"; if description...
Tpshop 2.0.8 Arbitrary File Download / SSRF Vulnerability
Tpshop versions 2.0.8 and below suffer from arbitrary file download and server-side request forgery vulnerabilities. Backdoor in Tpshop = 2.0.8 CVE-2018-9919 The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based...
Tpshop 2.0.8 Arbitrary File Download / SSRF
Backdoor in Tpshop = 2.0.8 CVE-2018-9919 The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based on the Thinkphp development framework. Product Download: http://www.tp-shop.cn/Index/Index/download.html Vulnerabili...
Drupal Avatar Uploader 7.x-1.0-beta8 Arbitary File Download Vulnerability
Exploit for php platform in category web applications Title: Arbitrary file download vulnerability in Drupal module avataruploader v7.x-1.0-beta8 Author: Larry W. Cashdollar CVE-ID:CVE-2018-9205 Download Site: https://www.drupal.org/project/avataruploader Vendor: https://www.drupal.org/u/robbinzh...
Drupal avatar_uploader arbitrary file download vulnerability
avataruploader is the module used to implement the function of uploading user images in a content management system maintained by the Drupal community. A security vulnerability exists in avataruploader version 7.x-1.0-beta8, which is caused by code in the view.php file that fails to validate user...
Gridbox com_gridbox, 2.4.0, Multiple Vulnerabilities
Gridbox comgridbox from balbooa.com, 2.4.0 and previous versions, multiple vulnerabilities including XSS, SQLi, arbitratry file download, insecure file upload, directory traversal Resolution: update to version 2.4.1.1 note that previous security release 2.4.1 fixed most of the issues but not all ...
Arbitrary File Download Vulnerability in Tianrongxin Vulnerability Scanning and Management System v3.3.0
TopScanner, abbreviated as TopScanner, is a vulnerability scanning and management assessment product launched by Beijing Tianrongxin based on years of experience in network security product development, including application detection, vulnerability scanning, vulnerability identification, risk...
Arbitrary File Download Vulnerability in Tianrongxin Vulnerability Scanning and Management System v3.3.0 (CNVD-2018-07855)
TopScanner, abbreviated as TopScanner, is a vulnerability scanning and management assessment product launched by Beijing Tianrongxin based on years of experience in network security product development, including application detection, vulnerability scanning, vulnerability identification, risk...
CoolMusicBox Upgrade Process Involves Arbitrary File Download Vulnerability
Coolmusic is a one-stop personalized music service platform that integrates music discovery, access and enjoyment. There is an arbitrary file download vulnerability in the update process of kwmusic, due to the use of insecure HTTP communication protocol to interact with the server, and did not...
Youku client update process suffers from arbitrary file download vulnerability
Youku PC client is a video player that supports both online and local use. An arbitrary file download vulnerability exists in the Youku PC client update process. The vulnerability is caused by the client update process using an insecure HTTP communication protocol to interact with the server, and...
Mitochrome upgrade process has an arbitrary file download vulnerability
Meitu Xiu Xiu is a photo manipulation software. Mito Xiu Xiu in the upgrade process exists arbitrary file download vulnerability, due to the program in the update process does not use any encryption algorithms, the query domain name does not exist any checksum mechanism, the new version of the...
Xunlei Download Software Upgrade Process Has Arbitrary File Download Vulnerability
Thunderbolt download is free download software based on multi-resource hyperthreading. Xunlei download software in the process of upgrading the arbitrary file download vulnerability, due to the use of insecure HTTP communication protocol to interact with the server, the attacker can take advantag...
CVE-2018-7235
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of the shell meta characters with the value of 'system.download.sdfile'...
CVE-2018-7234
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of SSL certificate...
Arbitrary File Download Vulnerability in CLTPHP Version 5.5.3
CLTPHP is a content management system based on ThinkPHP5 development with Layui framework in the backend. CLTPHP 5.5.3 version exists arbitrary file download vulnerability, an attacker can exploit the vulnerability to construct parameters to download arbitrary server files, such as script code,...
CVE-2018-7235: Improper Input Validation
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of the shell meta characters with the value of 'system.download.sdfile'...
Citrix NetScaler ADC and NetScaler Gateway Arbitrary File Download Vulnerability
Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway formerly known as Citrix Access Gateway Enterprise Edition are both products of Citrix Systems. NetScaler ADC is a service and application delivery solution Application Delivery Controller; NetScaler Gateway is a secure...