WordPress Download Manager < 3.1.18 - Unauthorised Download Duplication

The duplicate method, hooked to the admininit action did not have any CSRF and authorisation checks, allowing unauthorised users such as unauthenticated ones to duplicate arbitrary downloads As an unauthenticated or authenticated user, open the following URL to duplicate the Download with id 717...

CM Download Manager < 2.8.0 - Authenticated Arbitrary File Deletion

The plugin may allow authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action...

CM Download Manager < 2.8.0 - Unauthenticated Reflected Cross Site Scripting (XSS)

The plugin is vulnerable to Unauthenticated Cross Site Scripting XSS before version 2.8.0...

The vulnerability of the Adobe Download Manager’s download manager, related to incorrect elimination of special elements in the output data used by the incoming component, allows a hacker to execute arbitrary code.

The vulnerability of the Adobe Download Manager’s download manager is related to the incorrect elimination of certain elements in the output data used by the incoming component. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

Internet Download Manager 6.38.12 Buffer Overflow

Exploit Title: Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow PoC Date: November 18, 2020 Exploit Author: Vincent Wolterman Vendor Homepage: http://www.internetdownloadmanager.com/ Software Link: http://www.internetdownloadmanager.com/download.html Version:...

Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow Exploit

Exploit Title: Internet Download Manager 6.38.12 - Scheduler Downloads Scheduler Buffer Overflow PoC Exploit Author: Vincent Wolterman Vendor Homepage: http://www.internetdownloadmanager.com/ Software Link: http://www.internetdownloadmanager.com/download.html Version: 6.38.12 Tested on: Windows 7...

WordPress cm-download-manager cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress cm-download-manager versions prior to 2.8.0. The...

WordPress CM Download Manager plugin <= 2.7.0 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by qwebee in WordPress CM Download Manager plugin versions = 2.7.0. Solution Update the WordPress CM Download Manager plugin to the latest available version at least 2.8.0...

CM Download Manager < 2.8.0 - Authenticated Cross-Site Scripting

The plugin does not properly validate and sanitise the uploaded filename, which could result in a Cross-Site Scripting issue. PoC Vulnerable page - 'cmdownload/add/' Vulnerable parameter - 'filename' in 'Content-Disposition' Header POST /cmdownload/add/ HTTP/1.1 Host: localhost:8081 User-Agent:...

CVE-2020-27344

The cm-download-manager plugin before 2.8.0 for WordPress allows XSS...

Cross site scripting

The cm-download-manager plugin before 2.8.0 for WordPress allows XSS...

CVE-2020-27344

The cm-download-manager plugin before 2.8.0 for WordPress allows XSS...

CVE-2020-27344

The CVE-2020-27344 entry corresponds to a Cross-Site Scripting (XSS) flaw in the WordPress plugin cm-download-manager, affected until version 2.8.0. The root cause is improper validation/sanitization of client-supplied data, specifically the uploaded filename in Content-Disposition, which can all...

CVE-2020-9688

Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2020-9688

Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution...

Command injection

Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2020-9688

CVE-2020-9688 affects Adobe Download Manager for Windows, version 2.0.0.518. The issue is a command-injection vulnerability that could allow arbitrary code execution in the context of the current user when exploited. The CVSS data indicates a local attack vector requiring user interaction. Adobe ...

CVE-2020-9688

Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution...

Adobe Download Manager Injection Vulnerability

Adobe Download Manager is an application for managing and downloading Adobe products from Adobe USA. An injection vulnerability exists in version 2.0.0.518 of Adobe Download Manager for Windows-based platforms. An attacker can exploit this vulnerability to execute arbitrary code...

Adobe Discloses Critical Code-Execution Bugs in July Update

Adobe has released its scheduled July 2020 security updates, covering flaws in five different product areas: Creative Cloud Desktop; Media Encoder; Download Manager; Genuine Service; and ColdFusion. Four of the bugs are rated critical in severity, with the others ranked as important. Most of the...