The vulnerability of the proxy server of the Zscaler Client Connector allows attackers to circumvent security restrictions and gain increased privileges.

The vulnerability of the Zscaler Client Connector software proxy relates to the unlimited download of dangerous files. Exploiting this vulnerability can allow a hacker to bypass security restrictions and enhance their privileges by sending specially crafted requests...

Firefox v.117 Denial Of Service Exploit

This is barely a DoS, but since Chrome has explicit protection against it, we decided to disclose it. If firefox user visits a specially crafted page, then firefox may create many files in /Downloads, The user is notified about this in a small dialog, but there is no option to stop the downloads...

Firefox 117 Denial Of Service

This is barely a DoS, but since Chrome has explicit protection against it, we decided to disclose it. If firefox user visits a specially crafted page, then firefox may create many files in /Downloads, The user is notified about this in a small dialog, but there is no option to stop the downloads...

WordPress Easy Digital Downloads Plugin 3.1.0.2 - 3.1.0.3 SQLi Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sandhillsdev:easydigitaldownloads"; ifdescription...

The vulnerability of the network and application monitoring tool VMware Aria Operations for Networks, which allows unauthorized users to download files of a malicious nature, enables attackers to execute arbitrary code.

The vulnerability of the network and application monitoring tool in VMware Aria Operations for Networks relates to the unlimited download of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of ScrutisWeb monitoring software for bank ATMs lies in its ability to download files of a malicious nature without limitation, allowing an attacker to execute arbitrary code.

The vulnerability of ScrutisWeb banknote monitoring software lies in its ability to download unlimited amounts of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by downloading any file...

CVE-2023-39961 Text does not respect "Allow download" permissions

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and...

CVE-2023-30704

Improper Authorization vulnerability in Samsung Internet prior to version 22.0.0.35 allows physical attacker access downloaded files in Secret Mode without user authentication...

CVE-2023-38689 Deserialization of Untrusted Data in network IO

Logistics Pipes is a modification a.k.a. mod for the computer game Minecraft Java Edition. The mod used Java's ObjectInputStreamreadObject on untrusted data coming from clients or servers over the network resulting in possible remote code execution when sending specifically crafted network packet...

Tenable Nessus < 10.5.4 Multiple Vulnerabilities (TNS-2023-27)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.5.4. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-27 advisory. - Nessus leverages third-party software to help provide underlying functionality...

The vulnerability of the JBrowse browser, which allows for unlimited downloading of files of a malicious nature, enables attackers to execute arbitrary code.

The vulnerability of the JBrowse browser is related to the unlimited downloading of files of a malicious nature. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Missing Authorization

sentry is vulnerable to Missing Authorization. The vulnerability exists in the download function at debugfiles.py due to not restricting file downloads to unauthenticated users of a different project which allows an attacker to perform arbitrary file downloads of debug or artifact bundles of an...

CVE-2023-36826 Sentry vulnerable to improper authorization on debug and artifact file downloads

Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the...

GHSA-M4HC-M2V6-HFW8 Improper authorization on debug and artifact file downloads

Impact An authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. Patches A patch was issued to ensure authorization checks are proper...

Design/Logic Flaw

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the...

CVE-2023-3813

CVE-2023-3813 affects Jupiter X Core for WordPress. Versions up to and including 2.5.0 are vulnerable to unauthenticated arbitrary file downloads from the server, potentially exposing sensitive contents. The vulnerability is related to Jupiter X Core’s handling of file access and is described as ...

CVE-2023-3813 Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Download

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file downloads in versions up to, and including, 4.6.6. This makes it possible for unauthenticated attackers to download the contents of arbitrary files on the server, which can contain sensitive information. The requires the...

WordPress Import Holded for WooCommerce or Easy Digital Downloads Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

Software Import Holded for WooCommerce or Easy Digital Downloads Type Plugin Vulnerable versions = 1.3 Fixed in 2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID b0d5eca11d7a Credits...

WordPress Bulk Edit Easy Digital Downloads – Fast Bulk Creator Plugin < 1.0.62 is vulnerable to Cross Site Scripting (XSS)

Software Bulk Edit Easy Digital Downloads – Fast Bulk Creator Type Plugin Vulnerable versions 1.0.62 Fixed in 1.0.62 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9f06b59d7222...

WordPress Easy Digital Downloads – Courses Plugin <= 0.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Easy Digital Downloads – Courses Type Plugin Vulnerable versions = 0.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 03375981d3ea Credits Rafie Muhammad...