CVE-2023-27856

In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed...

Rockwell Automation ThinManager 路径遍历漏洞

Rockwell Automation ThinManager is a thin client management software from Rockwell Automation, Inc. It allows thin clients to be assigned to multiple remote desktop servers at the same time. A path traversal vulnerability exists in Rockwell Automation ThinManager ThinServer, which can be exploite...

CVE-2023-22335

Improper access control vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to bypass access restriction and download an arbitrary file of the directory where the product runs. As a result of exploiting this vulnerability with...

PT-2023-18438 · Dos Co. +1 · Ss1/Rakuraku Pc Cloud +2

Improper access control vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to bypass access restriction and download an arbitrary file of the directory where the product runs. As a result of exploiting this vulnerability with...

The vulnerability of the Apex One antivirus software is caused by deficiencies in the authentication process, which allows a hacker to download arbitrary files into the SampleSubmission directory.

The vulnerability of the anti-virus software Apex One is due to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to download arbitrary files into the SampleSubmission directory by using the Content-Length header in the HTTP PUT request sent to the...

WordPress Correos Oficial Plugin <= 1.3.0.0 is vulnerable to Arbitrary File Download

Software Correos Oficial Type Plugin Vulnerable versions = 1.3.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-0331 Patch priority Low CVSS severity Low 8.6 Developer Claim ownership PSID 8d6ba27c44e0 Credits Andrea Iodice Required...

CVE-2023-26758

Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceService...

Design/Logic Flaw

Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceService...

CVE-2023-0331

CVE-2023-0331 concerns the Correos Oficial WordPress plugin. The provided documents confirm a lack of authorization checks during file-path generation, enabling unauthenticated arbitrary file download from the server. Affected product: Correos Oficial WordPress plugin. Reported vulnerable version...

CVE-2023-0331 Correos Oficial <= 1.2.0.2 - Unauthenticated Arbitrary File Download

The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server...

CVE-2023-26758

Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceService...

CVE-2023-26758

Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceService...

PT-2023-20780 · Unknown · Sme.Up Tokyo

Name of the Vulnerable Software and Affected Versions: Sme.UP TOKYO version V6R1M220406 Description: The issue is related to an arbitrary file download via the /ResourceService component. This allows unauthorized access to files. Recommendations: For Sme.UP TOKYO version V6R1M220406, as a tempora...

Sme.UP ERP TOKYO V6R1M220406 路径遍历漏洞

Sme.UP ERP is a management software developed by Sme.UP, an Italian company, to meet the needs of its customers. A security vulnerability exists in Sme.UP ERP TOKYO V6R1M220406 version, which originates from an arbitrary file download vulnerability...

CVE-2023-26758

Affected software: Sme.UP TOKYO V6R1M220406. Vulnerability: An arbitrary file download vulnerability exists in the /ResourceService component. Root cause / vector: Unspecified in detail beyond the /ResourceService path being vulnerable; affected product exposed to file download via that component...

WordPress GMAce Plugin <= 1.5.2 is vulnerable to Arbitrary File Download

Software GMAce Type Plugin Vulnerable versions = 1.5.2 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Download CVE CVE-2023-23872 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 4ffc557c3ed7 Credits Mika Required privilege Administrat...

SUSE CVE-2007-6278

Free Lossless Audio Codec FLAC libFLAC before 1.2.1 allows user-assisted remote attackers to force a client to download arbitrary files via the MIME-Type URL flag -- for the FLAC image file in a crafted .FLAC file...

CVE-2023-22854

The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information...

Mitel MiContact Center Business 安全漏洞

Mitel MiContact Center Business is an all-media contact center platform from Mitel. The platform is used for customer communication, production management and other scenarios. A security vulnerability exists in the Mitel MiContact Center Business server versions 9.2.2.0 to 9.4.1.0, which is cause...

WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Arbitrary File Download

Software Shortcodes Ultimate Type Plugin Vulnerable versions = 5.12.6 Fixed in 5.12.7 OWASP Top 10 A3: Sensitive Data Exposure Classification Arbitrary File Download CVE CVE-2023-25050 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 547ac1ab598f Credits Rafie Muhammad...