File Download Vulnerability in EWEB Network Management System of Beijing StarNet Ruijie Network Technology Co.

Ruijie Networks is a specialized network vendor with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products and storage. A file download vulnerability exists in the EWEB network management system of Beijing StarN...

UniSharp Laravel Filemanager directory traversal vulnerability

UniSharp laravel-filemanager aka Laravel Filemanager with league/flysystem version = 2.0.0...

Arbitrary file deletion

Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API...

openSUSE 15 Security Update : python-Django (openSUSE-SU-2022:10103-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2022:10103-1 advisory. - An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a...

CVE-2022-36226

SiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax/ajaxOtherService.aspx...

CVE-2022-1585

The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php...

CVE-2022-2222

CVE-2022-2222 affects the WordPress Download Monitor plugin. Versions prior to 4.5.91 fail to constrain downloaded files to the blog directory, enabling high-privilege users (e.g., admins) to download sensitive files such as wp-config.php or /etc/passwd. The issue is described across multiple sou...

python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py

A flaw was found in the pip package installer for Python when downloading or installing a remote package via a specified URL. Improper validation of the "Content-Disposition" HTTP response header makes a path traversal attack possible, leading to an arbitrary file overwrite. This flaw allows an...

Security Vulnerabilities fixed in Firefox 101 — Mozilla

A malicious website could have learned the size of a cross-origin resource that supported Range requests. A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. When exiting fullscreen mode, an iframe could have...

Security Vulnerabilities fixed in Thunderbird 91.10 — Mozilla

A malicious website could have learned the size of a cross-origin resource that supported Range requests. A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. When exiting fullscreen mode, an iframe could have...

Security Vulnerabilities fixed in Firefox ESR 91.10 — Mozilla

A malicious website could have learned the size of a cross-origin resource that supported Range requests. A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. When exiting fullscreen mode, an iframe could have...

HashiCorp go-getter 命令注入漏洞

HashiCorp go-getter is a library for Go golang from HashiCorp, Inc. that is used to download files or directories from various sources using URLs as the primary form of input. A command injection vulnerability exists in HashiCorp go-getter version 2.0.2 and prior versions, which stems from the...

GHSA-XJMX-CPRH-646R MantisBT unauthorized users able to access private files

An issue was discovered in filedownload.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the supposedly private attachments linked to these notes by accessing the corresponding file download URL directly...

Denial Of Service (DoS)

nicotine-plus is vulnerable to denial of service. The fileisshared function of shares.py does not properly handle invalid file paths in the file download requests, allowing an attacker to crash the application by providing null characters to the file path...

Xerte 路径遍历漏洞

Xerte is an open source software from The Xerte Project community in the UK. Used to create learning objects. Xerte has a security vulnerability that stems from a directory traversal vulnerability in the Xerte Project Xerte to 3.10.3 when downloading project files via download.php. No details of...

CVE-2022-25104

HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/...

CVE-2021-25004

The CVE-2021-25004 entry concerns WordPress plugin SEUR Oficial (versions before 1.7.2). The vulnerability arises from the plugin creating a PHP file with a random name used for support, which enables an authenticated attacker to download arbitrary files from the web server when given the URL and...

CVE-2021-31567 WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability

Authenticated admin+ Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin versions = 4.4.6. The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadablefileurls0 parameter data. It's also...

Arbitrary file deletion

An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...

CVE-2021-38147

Wipro Holmes Orchestrator 20.4.1 is affected by CVE-2021-38147, an information-disclosure vulnerability. Unauthenticated attackers can access API endpoints processexecution/DownloadExcelFile/{Domain_Credential_Report_Excel|User_Report_Excel|Process_Report_Excel|Infrastructure_Report_Excel|Resolve...