SimpleHelp 安全漏洞

SimpleHelp is a remote support software from SimpleHelp, Inc. A security vulnerability exists in SimpleHelp 5.5.7 and earlier versions that stems from vulnerability to multiple path traversal vulnerability, which allows an attacker to download arbitrary files via a specially crafted HTTP request...

CVE-2024-57727

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing...

CVE-2024-43660 Arbitrary file download using <redacted>.sh

The CGI script .sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 24120701. Likelihood: High, but credentials required. Impact: Critical – The script can be used to download any file on the filesystem, including...

CVE-2024-43660

The CVE-2024-43660 issue affects Iocharger AC model chargers running firmware before 24120701. A CGI script (.sh) can be abused to download arbitrary files from the device filesystem (e.g., /etc/shadow, script source, binaries, config files). Attack is network-exposed and can be executed with low...

CVE-2024-43660 Arbitrary file download using <redacted>.sh

The CGI script .sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 24120701. Likelihood: High, but credentials required. Impact: Critical – The script can be used to download any file on the filesystem, including...

WordPress MIPL WC Multisite Sync plugin <= 1.1.5 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by nvthien in WordPress Plugin MIPL WC Multisite Sync versions = 1.1.5...

CVE-2024-56248 WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Webdeclic WPMasterToolKit allows Path Traversal.This issue affects WPMasterToolKit: from n/a through 1.13.1...

WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by l8BL Patchstack Alliance in WordPress Plugin WPMasterToolKit versions = 1.13.1...

WordPress Easy Digital Downloads plugin <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download vulnerability

Authenticated Admin+ Arbitrary File Download vulnerability discovered by Sajjad Ahmad jacksparrow in WordPress Plugin Easy Digital Downloads versions = 3.3.2...

CVE-2024-12875 Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level acces...

CVE-2024-12875 Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level acces...

CVE-2024-54259 WordPress DELUCKS SEO plugin <= 2.7.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through = 2.7.0...

WordPress DELUCKS SEO plugin <= 2.7.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin DELUCKS SEO versions = 2.7.0...

CVE-2024-53982 Arbitrary file download in Zoo-Project Echo Example

ZOO-Project is a C-based WPS Web Processing Service implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is...

Arbitrary File Download Vulnerability in DMagent of Damon 8 Database of Wuhan Damon Database Co.

Founded in 2000, Wuhan Damon Database Co., Ltd. is a leading database product development service provider in China. There is an arbitrary file download vulnerability in the DMagent of the Damon 8 database of Wuhan Damon Database Co., Ltd. that can be exploited by attackers to obtain sensitive...

WordPress Jobify - Job Board WordPress Theme Theme <= 4.2.3 is vulnerable to Arbitrary File Download

Software Jobify - Job Board WordPress Theme Type Theme Vulnerable versions = 4.2.3 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Download CVE CVE-2024-52481 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID d63150ac42f8 Credits Anand...

CVE-2024-52390 WordPress CYAN Backup plugin <= 2.5.3 - Arbitrary File Download vulnerability

Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through = 2.5.3...

CVE-2024-52390

CVE-2024-52390 affects the WordPress plugin CYAN Backup (versions n/a through 2.5.3). The issue is a Path Traversal vulnerability enabling an Arbitrary File Download. Public sources (NVD, Red Hat advisory, Patchstack) reiter show the affected range and that a fix exists in 2.5.4. CVSSv3.1 base sc...

CVE-2024-44757

An arbitrary file download vulnerability in the component /Basics/DownloadInpFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitrary files and access sensitive information via a crafted interface request...

CVE-2024-44757

An arbitrary file download vulnerability in the component /Basics/DownloadInpFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitrary files and access sensitive information via a crafted interface request...