Denial Of Service (DoS)

nicotine-plus is vulnerable to denial of service. The fileisshared function of shares.py does not properly handle invalid file paths in the file download requests, allowing an attacker to crash the application by providing null characters to the file path...

CVE-2022-25104

HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/...

CVE-2021-25004

The CVE-2021-25004 entry concerns WordPress plugin SEUR Oficial (versions before 1.7.2). The vulnerability arises from the plugin creating a PHP file with a random name used for support, which enables an authenticated attacker to download arbitrary files from the web server when given the URL and...

CVE-2021-31567 WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability

Authenticated admin+ Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin versions = 4.4.6. The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadablefileurls0 parameter data. It's also...

Arbitrary file deletion

An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...

CVE-2021-38147

Wipro Holmes Orchestrator 20.4.1 is affected by CVE-2021-38147, an information-disclosure vulnerability. Unauthenticated attackers can access API endpoints processexecution/DownloadExcelFile/{Domain_Credential_Report_Excel|User_Report_Excel|Process_Report_Excel|Infrastructure_Report_Excel|Resolve...

CVE-2021-40359

CVE-2021-40359 is a path traversal vulnerability in Siemens products (OpenPCS 7, SIMATIC BATCH, SIMATIC NET PC Software, SIMATIC PCS 7, SIMATIC Route Control, SIMATIC WinCC, etc.). The issue arises from improper neutralization of special elements in pathnames when downloading files, allowing an a...

Siemens SIMATIC PCS 7和SIMATIC WinCC 路径遍历漏洞

Siemens SIMATIC PCS 7 and SIMATIC WinCC are both products of Siemens, a German company. SIMATIC PCS 7 is a process control system and SIMATIC WinCC is an automated data acquisition and monitoring SCADA system. A path traversal vulnerability exists in SIMATIC PCS 7 and SIMATIC WinCC, which stems...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker with administrative read-only privileges to download files that should be restricted. This vulnerability is due to incorrect permissions settings on an affecte...

Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download Vulnerability

Exploit Title: Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download Exploit Author: LiquidWorm Vendor Homepage: http://www.ljkj2012.com Longjing Technology BEMS API 1.21 Remote Arbitrary File Download Vendor: Longjing Technology Product web page: http://www.ljkj2012.com Affected...

Arbitrary File Download Vulnerability in PatrolFlow Multi-service Security Gateway Intelligent Management Platform of Beijing Byzoro Network Technology Co.

Beijing Byzoro Network Technology Co., Ltd. is a high-tech enterprise dedicated to building the next-generation secure Internet. PatrolFlow Multi-service Security Gateway Intelligent Management Platform of Beijing Byzoro Networks Technology Co., Ltd. suffers from an arbitrary file download...

QSAN Storage Manager Access Control Error Vulnerability

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. An improper access control vulnerability exists in sharelink in QSAN Storage Manager 3.3.1 and earlier versions. A remote attacker could exploit this vulnerability to download arbitrary files via specific...

Arbitrary File Download Vulnerability in Bova NetDragon Firewall

Ltd. is a high-tech enterprise integrating scientific research, product development, technical service and system integration. An arbitrary file download vulnerability exists in Bohua NetDragon Firewall, which can be exploited by attackers to obtain sensitive information...

PT-2021-19742 · Qsan · Qsan Storage Manager

Name of the Vulnerable Software and Affected Versions: QSAN Storage Manager versions prior to 3.3.3 Description: The issue is related to improper access control in the share link feature of QSAN Storage Manager, allowing remote attackers to download arbitrary files by exploiting a particular...

Arbitrary File Download Vulnerability in Secure Router of Riseconda Technology Development Co.

Focusing on the field of fiber optic broadband access, Riseconda Technology Development Co., Ltd. is committed to the convergence of fiber optic technology, Ethernet technology and broadband access technology. An arbitrary file download vulnerability exists in the security router of Riseconda...

Arbitrary file deletion

OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability...

Arbitrary File Download Vulnerability in H3C S1526

H3C S1526 is a new generation switch launched by Xinhua San Technologies Co. It is targeted at the cultural industry market such as Internet cafes, sing-along bars and digital movie theaters. The H3C S1526 suffers from an arbitrary file download vulnerability that can be exploited by attackers to...

Arbitrary File Download Vulnerability in Viwit Information TMS System

Vantage Information is a company that provides customers with a comprehensive logistics hybrid cloud solution that integrates intelligence and mobile connectivity and supports microservices architecture. An arbitrary file download vulnerability exists in Viwit's TMS system, which can be exploited...

Arbitrary File Download Vulnerability in AmarALS Credit Risk Management System

AmarALS Credit Risk Management System is a "Credit Risk Management Support System" covering all aspects of credit risk management for commercial banks. An arbitrary file download vulnerability exists in the AmarALS Credit Risk Management System, which can be exploited by an attacker to download...

Arbitrary File Download Vulnerability in Dahua In-vehicle Integrated Management Platform of Zhejiang Dahua Technology Co.

Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. An arbitrary file download vulnerability exists in the Dahua vehicle integrated management platform of Zhejiang Dahua Technology Co. An attacker can exploit the vulnerability ...