161 matches found
Design/Logic Flaw
The WP Import Export WordPress plugin both free and premium versions is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for...
CVE-2022-0236
CVE-2022-0236 affects the WordPress plugin WP Import Export (free & premium) up to version 3.9.15. The root cause is a missing capability check in the download function wpie_process_file_download (in ~/includes/classes/class-wpie-general.php), allowing unauthenticated attackers to disclose sensit...
CVE-2021-45789
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function...
CVE-2021-45789
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function...
PT-2021-24297 · Unknown · Metersphere
Name of the Vulnerable Software and Affected Versions: Metersphere version 1.15.4 Description: An arbitrary file read issue was found, allowing authenticated users to read any file on the server via the file download function. Recommendations: For Metersphere version 1.15.4, consider restricting...
CVE-2021-44162: Improper Limitation of a Pathname to a Restricted Directory
Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in URL parameters, which allows a remote attacker to download arbitrary system files without authentication...
PT-2021-23473
Name of the Vulnerable Software and Affected Versions SIMATIC eaSie PCS 7 Skill Package versions prior to V21.00 SP3 Description A vulnerability has been identified where the affected systems do not properly neutralize special elements within the pathname when downloading files. This could allow ...
Deskpro 跨站脚本漏洞
Deskpro is a suite of helpdesk software from Deskpro UK. The software includes a customer relationship management component, among other things, and provides features such as email, live chat, and voice. A security vulnerability exists in Deskpro cloud and on-premise Deskpro versions 2021.1.6 and...
CVE-2020-7865
A vulnerabilityimproper input validation in the ExECM CoreB2B solution allows an unauthenticated attacker to download and execute an arbitrary file via httpDownload function. A successful exploit could allow the attacker to hijack vulnerable system...
CVE-2021-32527
Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files thru injecting file path in download function. Suggest contacting with QSAN and refer to recommendations in QSAN Document...
Path traversal
Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files thru injecting file path in download function. Suggest contacting with QSAN and refer to recommendations in QSAN Document...
CVE-2021-32527 QSAN Storage Manager - Path Traversal-2
Path traversal vulnerability in QSAN Storage Manager allows remote unauthenticated attackers to download arbitrary files thru injecting file path in download function. Suggest contacting with QSAN and refer to recommendations in QSAN Document...
CVE-2021-32517: Improper Access Control
Improper access control vulnerability in sharelink in QSAN Storage Manager allows remote attackers to download arbitrary files using particular parameter in download function. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3...
CVE-2021-28172: Improper Limitation of a Pathname to a Restricted Directory
There is a Path Traversal vulnerability in the file download function of Vangene deltaFlow E-platform. Remote attackers can access credential data with this leakage...
CVE-2021-27132
SerComm AG Combo VD625 AGSOT2.1.0 devices allow CRLF injection for HTTP header injection in the download function via the Content-Disposition header...
CVE-2021-27132
The CVE-2021-27132 issue affects Sercomm VD625 Smart Modems (firmware AGSOT_2.1.0). The vulnerability is a CRLF injection in the Content-Disposition header during the download function, enabling header manipulation that could enable session hijacking, cross-site scripting, or cache poisoning as d...
CVE-2021-27132
SerComm AG Combo VD625 AGSOT2.1.0 devices allow CRLF injection for HTTP header injection in the download function via the Content-Disposition header...
CVE-2021-27132: Improper Neutralization of Special Elements in Output Used by a Downstream Component
SerComm AG Combo VD625 AGSOT2.1.0 devices allow CRLF injection for HTTP header injection in the download function via the Content-Disposition header...
PT-2021-17255
Name of the Vulnerable Software and Affected Versions: SerComm AG Combo VD625 AGSOT version 2.1.0 Description: The issue allows CRLF injection, which can lead to HTTP header injection, in the download function via the Content-Disposition header. Recommendations: For SerComm AG Combo VD625 AGSOT...