7877 matches found
WordPress Strategery Migrations Plugin <= 1.0 is vulnerable to Arbitrary File Download
Software Strategery Migrations Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Download CVE CVE-2024-35745 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 56c2660b4cfb Credits YCInfosec Required...
WordPress Ovic Importer Plugin <= 1.6.3 is vulnerable to Arbitrary File Download
Software Ovic Importer Type Plugin Vulnerable versions = 1.6.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-35754 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID cc9fdc38f203 Credits Majed Refaea Required privile...
MCms File Upload
The vulnerability of the /ms/file/upload.do file in the MCms content management system is related to the ability to download files of a dangerous type without restrictions. Exploiting this vulnerability allows a malicious actor to download any files by sending a specially crafted POST request...
CVE-2024-35431
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...
CVE-2024-35431
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...
CVE-2024-35431
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...
CVE-2024-35431: Path Traversal: 'dir\..\..\filename'
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...
ZKTeco ZKBioSecurity 安全漏洞
ZKTeco ZKBioSecurity is a web-based all-in-one platform from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco ZKBioSecurity version 6.1.1, which originates from a directory traversal vulnerability in photoBase64 that allows unauthenticated users to download local files from t...
CVE-2024-28826 Unrestricted upload and download paths in check_sftp
Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...
CVE-2024-35343
Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L,...
CVE-2024-35343
Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L,...
Campbell Scientific CSI Web Server
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION : Exploitable remotely/low attack complexity Vendor : Campbell Scientific Equipment : CSI Web Server Vulnerabilities : Path Traversal, Weak Encoding for Password 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...
多款Anpviz产品 安全漏洞
Anpviz IPC is a series of network cameras from Anpviz. A security vulnerability exists in multiple Anpviz products that originates from a vulnerability that allows an unauthenticated attacker to download arbitrary files from the device's filesystem to /reloading/URI via an HTTP GET request.Affect...
CVE-2024-35343: Exposure of Sensitive Information to an Unauthorized Actor
Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L,...
CVE-2024-4388
This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server...
CVE-2024-4388
The WordPress Theme CAS (versions <= 1.0.0 ) is vulnerable to an Unauthenticated Arbitrary File Access vulnerability. The root cause is a lack of validation on a path generated with user input when downloading files. This allows an unauthenticated attacker to download arbitrary files from the ...
CVE-2024-4388: Undefined Security Weakness
This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server...
WordPress Theme CAS 安全漏洞
WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on PHP and MySQL servers.WordPress theme is a theme for WordPress. A security vulnerability exists in WordPress Theme CAS 1.0.0 and earlier versions, which stems from a...
PT-2024-26310 · Unknown · Luckyframeweb
Name of the Vulnerable Software and Affected Versions: LuckyFrameWeb version 3.5.2 Description: The issue allows for arbitrary file deletion via the fileName parameter in the fileDownload method. Recommendations: For version 3.5.2, avoid using the fileName parameter in the fileDownload method unt...
SuiteCRM File Download Restriction
The vulnerability of the SuiteCRM customer relationship management system is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to execute or open files on the web server without having access to those files...