CVE-2020-7803

IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution...

Arbitrary file deletion

IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution...

CVE-2020-7803 Zoneplayer ActiveX File Download Vulnerability

IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution...

CVE-2020-11732

The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mlagallery link=download...

Nextcloud Server Access Control Error Vulnerability (CNVD-2020-21014)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An access control error vulnerability exists in Nextcloud Server versions prior to 18.0.1, 17.0.4 and 16.0.9, which can be exploited by an attacker to downloa...

CVE-2020-8809

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attack...

Authorization

Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability...

DEBIAN-CVE-2019-13710

Insufficient validation of untrusted input in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download restrictions via a crafted HTML page...

CVE-2019-1877 Cisco Enterprise Chat and Email Attachment Download Vulnerability

A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could explo...

CVE-2019-16986

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. resources\securedownload.php is also affected...

Design/Logic Flaw

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. resources\securedownload.php is also affected...

CVE-2019-16990

In FusionPBX up to v4.5.7, the file app/musiconhold/musiconhold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname base64 encoded and allows a download of it...

V-SOL GPON / EPON OLT Platform File Download Vulnerability

V-SOL GPON is a network switch device. A file download vulnerability exists in the V-SOL GPON / EPON OLT platform, which can be exploited by an attacker to download a download configuration...

Unauthorized Download Vulnerability in Kaixin Quote System

Qixing Quotation System V2.0 is a general management system developed for material quotations. Unauthorized download vulnerability exists in the Qixing Quotation System, which can be exploited by an attacker to obtain sensitive information by unauthorized downloading of sensitive files...

Google Chrome has multiple file download vulnerabilities

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 77.0.3865.75. A remote attacker can exploit the vulnerability to bypass file download protection with the help of a specially crafted website...

Multiple Vulnerabilities in Youmu's Learning Platform

Ltd. is a company that builds institutions' informatized teaching and management support system based on the comprehensive platform of Youmu class online education. There are multiple vulnerabilities in the UMOCL learning platform, which can be exploited by attackers to arbitrarily upload, downlo...

CVE-2019-13408

CVE-2019-13408 describes a relative path traversal vulnerability in Advan VD-1 firmware up to version 230, allowing unauthenticated download of arbitrary files via cgibin/ExportSettings.cgi?Download=filepath. Exploitation details and affected products in connected sources include GeoVision/OT plu...

CVE-2019-3415

CVE-2019-3415 affects ZTE ZXMW/MW NR8000 devices (versions V2.4.4.03 and V2.4.4.04). Multiple connected sources describe a path traversal vulnerability that allows an attacker to access files outside a restricted directory and download arbitrary files. Root cause appears to be improper validation...

CVE-2019-1717

A vulnerability in the web-based management interface of Cisco Video Surveillance Manager could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper validation of parameters handled by the web-based management interface. An attacker could...

DoorGets Sensitive Information Disclosure Vulnerability (CNVD-2019-13793)

DoorGets is a free and open source content management system. A sensitive information disclosure vulnerability exists in /fileman/php/download.php in doorGets 7.0. A remote, unauthenticated attacker can exploit this vulnerability to obtain sensitive information about the server...