PT-2020-10163

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine versions prior to 4.8.0 Description The issue concerns an arbitrary file download found in the "Download Log" functionality. This allows for potential unauthorized access to files. Recommendations For versions prior to...

CVE-2019-19454: Undefined Security Weakness

An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine = 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0...

CVE-2017-13987: Undefined Security Weakness

An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows an unauthorized user to download log files...

CVE-2016-9459

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment...

PT-2017-10150

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.52 ownCloud Server versions prior to 9.0.4 Description The issue concerns a log pollution vulnerability that could potentially lead to a local XSS. The download log functionality in the admin screen...

CVE-2016-9459: Generation of Error Message Containing Sensitive Information

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment...

CVE-2016-10201

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php...

CVE-2016-10201

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php...

CVE-2016-10201

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php...

CVE-2016-10201

Cross-site scripting XSS vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php...

PT-2017-7799

Name of the Vulnerable Software and Affected Versions Zoneminder versions 1.30 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to "index.php". Recommendations For Zoneminder...

OwnCloud 'Download Log' Functionality Cross-Site Scripting Vulnerability

OwnCloud is a free and open source personal cloud storage solution from German company OwnCloud. The solution offers file management, music storage, calendars and more. A cross-site scripting vulnerability exists in OwnCloud 'Download Log' Functionality due to the program failing to properly filt...

Log pollution can potentially lead to local HTML injection - ownCloud

The "download log" functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the...

Server: Log pollution can potentially lead to local HTML injection

The "download log" functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the...

CVE-2016-1594

Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a 1 downloadLogFiles or 2 downloadFile action...

SYNCK GRAPHICA Download Log CGI Directory Traversal Vulnerability

A directory traversal vulnerability in the SYNCK GRAPHICA Download Log CGI allows remote attackers to overwrite arbitrary files in an application context using a directory traversal sequence with a specially crafted request '... /' to overwrite arbitrary files in the context of an application...

CVE-2015-0867

Directory traversal vulnerability in SYNCK GRAPHICA Download Log CGI 3.0 and earlier allows remote attackers to read arbitrary files via a crafted filename...

Directory traversal

Directory traversal vulnerability in SYNCK GRAPHICA Download Log CGI 3.0 and earlier allows remote attackers to read arbitrary files via a crafted filename...

CVE-2015-0867

CVE-2015-0867 is a directory traversal vulnerability in SYNCK GRAPHICA Download Log CGI, affecting version 3.0 and earlier. The flaw allows remote attackers to read arbitrary files by supplying a crafted filename. Public disclosures in JVN/NVD indicate root cause in the Download Log CGI’s file-na...

PT-2015-4925

Name of the Vulnerable Software and Affected Versions SYNCK GRAPHICA Download Log CGI versions 3.0 and earlier Description A directory traversal issue allows remote attackers to read arbitrary files by providing a crafted filename. Recommendations For versions 3.0 and earlier, at the moment, ther...