CVE-2023-46887

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability...

Dreamer CMS Security Vulnerability

Dreamer CMS is a dreamer content management system developed by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS versions prior to 4.0.1, which stems from an arbitrary file download vulnerability in the attachment management office feature...

PT-2023-30254 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS versions prior to 4.0.1 Description: The issue is related to an Arbitrary File Download vulnerability in the backend attachment management office. Recommendations: For versions prior to 4.0.1, update to version 4.0.1 or later to...

CVE-2023-46887

In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability...

CVE-2023-46887

In Dreamer CMS, versions prior to 4.0.1 expose an Arbitrary File Download vulnerability in the backend attachment management office. This affects the core product as described in CVE-2023-46887 with an attack vector that is network-based, no privileges required, and no user interaction, leading t...

WordPress JetElements For Elementor Plugin <= 2.6.13 is vulnerable to Arbitrary File Download

Software JetElements For Elementor Type Plugin Vulnerable versions = 2.6.13 Fixed in 2.6.13.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-48759 Patch priority High CVSS severity High 7.5 Developer Crocoblock PSID b2e64216e8cc Credits Rafie Muhammad...

VulnCheck KEV: CVE-2021-39316

The Zoomsounds plugin = 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsapdownload action using directory traversal in the link parameter...

Frontend File Manager < 22.7 - Editor+ Arbitrary File Download

Description The plugin has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as wp-config.php 1 Create new post with this shortcode - ffmwp 2 Go to new post and upload any file 3 After that go to main page of plugin for users...

WordPress Frontend File Manager Plugin < 22.6 is vulnerable to Arbitrary File Download

Software Frontend File Manager Type Plugin Vulnerable versions 22.6 Fixed in 22.6 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-5105 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID 66e0e4c68ed0 Credits Dmitrii Ignatyev...

Frontend File Manager < 22.7 - Editor+ Arbitrary File Download

Description The plugin has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as wp-config.php PoC 1 Create new post with this shortcode - ffmwp 2 Go to new post and upload any file 3 After that go to main page of plugin for users...

Cisco Firepower Management Center Software Arbitrary File Download Vulnerability

A vulnerability in the file download feature of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to download arbitrary files from an affected system. This vulnerability is due to a lack of input sanitation. An attacker could exploit this vulnerability b...

CVE-2023-45799

In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the victim download and execute arbitrary files...

WordPress ICS Calendar Plugin <= 10.12.0.3 is vulnerable to Arbitrary File Download

Software ICS Calendar Type Plugin Vulnerable versions = 10.12.0.3 Fixed in 10.12.0.4 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2023-46784 Patch priority Medium CVSS severity Medium 8.2 Developer Claim ownership PSID 662755066f6f Credits Muhammad Daffa Require...

WordPress Popup by Supsystic Plugin <= 1.10.19 is vulnerable to Arbitrary File Download

Software Popup by Supsystic Type Plugin Vulnerable versions = 1.10.19 Fixed in 1.10.20 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-46197 Patch priority Low CVSS severity Low 5.3 Developer Supsystic PSID deb6d3a6f13c Credits Rafshanzani Suhada Require...

Siemens CP-8031 路径遍历漏洞

The ICAM A8000 RTU Remote Terminal Unit series is a modular family of devices for remote control and automation applications in all areas of energy supply. A path traversal vulnerability exists in the Siemens SICAM A8000 device CPCI85 firmware web server, which can be exploited by an attacker to...

SICK APU Security Vulnerability

SICK APU is a railroad analysis system from SICK, Germany. A security vulnerability exists in the SICK APU RDT400 that stems from an arbitrary file download vulnerability. The vulnerability can be exploited by an attacker to download arbitrary files from a server via HTTP requests...

Arbitrary File Download Vulnerability in Yonyou UAP/NC of UFIDA Network Technology Co.

Founded in 1988, UFIDA is a global provider of advanced cloud services, software, and financial services for enterprises and public organizations. An arbitrary file download vulnerability exists in Yonyou UAP/NC, which can be exploited by attackers to obtain sensitive information...

CVE-2023-3512

Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter...

CVE-2023-36851

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauthoperation.php that doesn't require authentication, an...

Prestashop Path Traversal Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The program provides a variety of payment methods, short message alerts and product image zoom and other features. Prestashop plugin M4 PDF 3.2.3 and previous versions of a security vulnerability , the...