CVE-2024-8746 File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload

The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mkfilefoldermanagershortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if grant...

The vulnerability of the SAP Business Objects Business Intelligence Platform lies in its ability to download files of a dangerous type without limit, allowing attackers to compromise the integrity of the protected information.

The vulnerability of the SAP Business Objects Business Intelligence Platform relates to the unlimited loading of dangerous files. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of the protected information...

WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin WordPress Gallery Plugin – Limb Image Gallery versions = 1.5.7...

WordPress Ahime Image Printer plugin <= 1.0.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Ahime Image Printer versions = 1.0.0...

Hgiga OAKlouds 安全漏洞

HGiga OAKlouds is an enterprise collaborative work portal network of China Henderson Technology HGiga Company. It is used for just-in-time communication and resource reservation. HGiga OAKlouds suffers from a security vulnerability that originates from the fact that an unauthorized remote attacke...

WordPress WordPress Gallery Plugin – Limb Image Gallery Plugin <= 1.5.7 is vulnerable to Arbitrary File Download

Software WordPress Gallery Plugin – Limb Image Gallery Type Plugin Vulnerable versions = 1.5.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Download CVE CVE-2024-49258 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID f9ffdc125499 Credits...

WordPress Ahime Image Printer Plugin <= 1.0.0 is vulnerable to Arbitrary File Download

Software Ahime Image Printer Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-49245 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 4330a07d13a8 Credits stealthcopter Required...

MOXA Service 安全漏洞

MOXA Service is a hardware device infrastructure service from China MOXA MOXA. A security vulnerability exists in MOXA Service, which stems from a lack of authentication during command sending and could allow an attacker to execute specific commands, resulting in unauthorized configuration file...

WordPress Bit Form – Contact Form Plugin Plugin <= 2.15.2 is vulnerable to Arbitrary File Download

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions = 2.15.2 Fixed in 2.15.3 OWASP Top 10 A3: Injection Classification Arbitrary File Download CVE CVE-2024-9507 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 2674338e71f9 Credits TANG Cheuk Hei siunam...

Exploit for Insufficiently Protected Credentials in W3Eden Download_Manager

CVE-2023-6421 Download Manager 3.2.83 - Unauthenticated P...

CVE-2024-37179

SA P BusinessObjects BI Platform Web Intelligence is affected by an authenticated-file-download vulnerability. A logged-in user can send a crafted request to the Web Intelligence Reporting Server to download arbitrary files from the host machine, exposing confidentiality without impacting integri...

PT-2024-7172 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform affected versions not specified Description: The issue is related to a file download vulnerability in the SAP BusinessObjects Business Intelligence Platform, specifically in the Web...

Directory Traversal

OpenC3 COSMOS is vulnerable to Directory Traversal. The vulnerability is due to improper input validation in LocalMode's openlocalfile method, allowing an authenticated user with adequate permissions to download any .txt file via the ScreensControllershow endpoint on the web server...

Malicious File Download

scoutbrowser is vulnerable to Malicious File Download. The vulnerability is due to insufficient input validation for filenames, which does not properly sanitize the file extensions before serving the files to users, allowing attackers to manipulate file extensions and deliver malicious content...

CVE-2024-8352 Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the downloadlog function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

CVE-2024-8352 Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the downloadlog function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

WordPress Social Web Suite plugin <= 4.1.11 - Directory Traversal to Arbitrary File Download vulnerability

Directory Traversal to Arbitrary File Download vulnerability discovered by Thanh Nam Tran in WordPress Plugin Social Web Suite versions = 4.1.11...

WordPress Social Web Suite Plugin <= 4.1.11 is vulnerable to Arbitrary File Download

Software Social Web Suite Type Plugin Vulnerable versions = 4.1.11 Fixed in 4.1.12 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-8352 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 9b823a04681b Credits Thanh Nam Tran Required...

CVE-2024-46977 OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...

OpenC3 COSMOS 路径遍历漏洞

OpenC3 COSMOS is an OpenC3 open source application. A path traversal vulnerability exists in OpenC3 COSMOS versions prior to 5.19.0. An attacker exploits this vulnerability to download any .txt file by running ScreensControllershow on the web server...