2734 matches found
Sitecore Experience Platform 路径遍历漏洞
Sitecore Experience Platform XP is a suite of customer digital experience platforms from Sitecore, Denmark. A security vulnerability exists in Sitecore Experience Platform 10.2 and prior versions, which stems from a directory traversal vulnerability that allows remote attackers to download...
The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files from the file system.
The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download arbitrary files from the file system using...
PT-2023-20929 · Sitecore · Sitecore Experience Platform
Name of the Vulnerable Software and Affected Versions: Sitecore Experience Platform versions prior to 10.2 Description: The issue allows remote attackers to download arbitrary files via a crafted command to the "download.aspx" endpoint. This is achieved by exploiting a Directory Traversal...
Cisco Identity Services Engine 3.x < 3.2P1 Arbitrary File Download (cisco-sa-ise-file-dwnld-Srcdnkd2)
According to its self-reported version, Cisco Identity Services is affected by a vulnerability in the web-based management interface. These allow an authenticated, remote attacker to download arbitrary files from the file system of an affected device. These vulnerabilities are due to insufficient...
CVE-2023-20087
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...
CVE-2023-20077
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...
Cisco Identity Services Engine 路径遍历漏洞
Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An arbitrary file download vulnerability exists...
CVE-2023-20077 Cisco Identity Services Engine Arbitrary File Download Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...
CVE-2023-20077
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...
CVE-2023-2180 KIWIZ Invoices Certification & PDF System <= 2.1.3 - Unauthenticated Arbitrary File Download
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization assuming they can upload a file on the server...
WordPress KIWIZ Invoices Certification & PDF System Plugin <= 2.1.3 is vulnerable to Arbitrary File Download
Software KIWIZ Invoices Certification & PDF System Type Plugin Vulnerable versions = 2.1.3 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Download CVE CVE-2023-2180 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID daccef4ee9c6 Credits WPScan Required...
KIWIZ Invoices Certification & PDF System <= 2.1.3 - Unauthenticated Arbitrary File Download
The plugin does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization assuming they can upload a file on the server To download ../../../../wp-config.php:...
CVE-2023-27755
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...
CVE-2023-27755
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...
CVE-2023-27755
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...
CVE-2023-27755
go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download...
CVE-2023-27755
CVE-2023-27755 (go-bbs v1) is an arbitrary file download vulnerability in the /api/v1/download component. The connection between the affected code path and unauthorized file access is stated across multiple sources, with the root issue described as an arbitrary file download via the download endp...
CVE-2023-27179
GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /admin/imgdownload.php...