WordPress CYAN Backup plugin <= 2.5.3 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Junsu Yeo Patchstack Alliance in WordPress Plugin CYAN Backup versions = 2.5.3...

WordPress DigiPass plugin <= 0.3.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin DigiPass versions = 0.3.0...

WordPress DigiPass Plugin <= 0.3.0 is vulnerable to Arbitrary File Download

Software DigiPass Type Plugin Vulnerable versions = 0.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Download CVE CVE-2024-52378 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID dbfd2eb97192 Credits stealthcopter Required privilege Unauthenticat...

WordPress CYAN Backup Plugin <= 2.5.3 is vulnerable to Arbitrary File Download

Software CYAN Backup Type Plugin Vulnerable versions = 2.5.3 Fixed in 2.5.4 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-52390 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID b0f12165e19f Credits Junsu Yeo Required privilege...

CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

CVE-2024-50508 WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through = 1.0.0...

CVE-2024-50508 WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through = 1.0.0...

CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

CVE-2024-48735

CVE-2024-48735 : In SAS Studio 9.4, a Directory Traversal vulnerability exists in the /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} endpoint. A remote attacker could access internal files by manipulating the default path during file download. The vendor disputes the flaw, argui...

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by ghsinfosec Patchstack Alliance in WordPress Plugin Woocommerce Product Design versions = 1.0.0...

CVE-2024-50307

Use of potentially dangerous function issue exists in Chatwork Desktop Application Windows versions prior to 2.9.2. If a user clicks a specially crafted link in the application, an arbitrary file may be downloaded from an external website and executed. As a result, arbitrary code may be executed ...

WordPress Woocommerce Product Design Plugin <= 1.0.0 is vulnerable to Arbitrary File Download

Software Woocommerce Product Design Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-50508 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 6ce68eabacf0 Credits ghsinfosec...

Lawo AG vsm LTC Time Sync 路径遍历漏洞

Lawo vsm LTC Time Sync Lawo vTimeSync is an application from Lawo, Inc. A security vulnerability exists in Lawo AG vsm LTC Time Sync prior to version 4.5.6.0, which stems from the presence of a path traversal vulnerability that could allow an unauthenticated, remote attacker to download arbitrary...

The vulnerability of Nomad application orchestrators, related to incorrect resolution of link references before the file name, allows attackers to execute arbitrary code.

The vulnerability of Nomad application orchestrators is related to incorrect resolution of the link before the file is downloaded. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Wellchoose Administrative Management System 安全漏洞

Wellchoose Administrative Management System is an administrative management system from China Weiweiqiao Information Wellchoose Company. A security vulnerability exists in the Wellchoose Administrative Management System. A remote attacker could exploit this vulnerability to download arbitrary fil...

CVE-2024-49245 WordPress Ahime Image Printer plugin <= 1.0.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through = 1.0.0...

CVE-2024-49245 WordPress Ahime Image Printer plugin <= 1.0.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through = 1.0.0...

CVE-2024-49258 WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Download vulnerability

Path Traversal: '.../...//' vulnerability in Limb WordPress Gallery Plugin – Limb Image Gallery.This issue affects WordPress Gallery Plugin – Limb Image Gallery: from n/a through 1.5.7...

CVE-2018-25105

The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary file...