CVE-2023-47353

An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files...

CVE-2023-47353: Download of Code Without Integrity Check

An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files...

IMOU GO Security Vulnerability

IMOU GO is a mobile app for interacting with a car recorder. A security vulnerability exists in IMOU GO v1.0.11. An attacker can exploit the vulnerability to force the download of arbitrary files...

CVE-2023-47353

An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files...

PT-2024-13444 · Imou Go · Imou Go

Name of the Vulnerable Software and Affected Versions: IMOU GO version 1.0.11 Description: An issue in the com.oneed.dvr.service.DownloadFirmwareService component allows attackers to force the download of arbitrary files. Recommendations: For IMOU GO version 1.0.11, consider disabling the...

CVE-2023-32329

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a user to download files from an incorrect repository due to improper file validation. IBM X-Force ID: 254972...

WordPress Total Upkeep Plugin <= 1.15.8 is vulnerable to Arbitrary File Download

Software Total Upkeep Type Plugin Vulnerable versions = 1.15.8 Fixed in 1.15.9 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-24869 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 7a4ce347d2cf Credits Yudistira Arya Required privileg...

Cross-site Scripting Vulnerability on Data Import

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.10.1 and was tested on version 1.9.2.post0. Overview Label Studio had a remote import feature allowed users to...

Virtuozzo Hybrid Server 7.5 Update 6 (7.5.6-87)

Virtuozzo Hybrid Server 7.5 Update 6 introduces new features and provides stability, usability, and security bug fixes. Additionally, it provides a new kernel 3.10.0-1160.105.1.vz7.214.3. Vulnerability id: PSBM-151015, PSBM-153331 A critical security issue in container suspend/resume in the...

PT-2024-19985 · Unknown · Label Studio

Name of the Vulnerable Software and Affected Versions: Label Studio versions prior to 1.10.1 Description: The remote import feature in Label Studio allowed users to import data from a remote web source, which could be abused to download a HTML file that executed malicious JavaScript code in the...

Arbitrary File Download Vulnerability in DSS of Zhejiang Dahua Technology Co.(CNVD-2024-10023)

Zhejiang Dahua Technology Co., Ltd. is a supplier of surveillance products and solution service provider. Zhejiang Dahua Technology Co., Ltd DSS has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2023-48383: Improper Limitation of a Pathname to a Restricted Directory

NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files...

PT-2024-13608 · Netvision +1 · Netvision +1

Name of the Vulnerable Software and Affected Versions: NetVision affected versions not specified Description: The issue is related to a path traversal vulnerability within a parameter in a specific URL of airPASS. This vulnerability can be exploited by an unauthenticated remote attacker to bypass...

Path traversal

A vulnerability classified as problematic was found in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file download.php. The manipulation of the argument downloadfile leads to path traversal: '../filedir'. The exploit has been disclosed to the...

CVE-2024-0465

CVE-2024-0465 affects code-projects Employee Profile Management System 1.0, with the vulnerable path in the file download.php . The vulnerability stems from manipulating the download_file argument, enabling a path traversal to “../filedir”. Public disclosure of the exploit is noted. Several conne...

CVE-2024-0465 code-projects Employee Profile Management System download.php path traversal

A vulnerability classified as problematic was found in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file download.php. The manipulation of the argument downloadfile leads to path traversal: '../filedir'. The exploit has been disclosed to the...

CVE-2023-48246

CVE-2023-48246 affects Bosch Nexo/Nexo-OS devices. A crafted HTTP request can trigger downloading arbitrary files from all system paths under the application’s OS user context (root). Documented impact is file disclosure with root privileges; no exploitation details or likelihood provided. Public...

CVE-2023-48246

The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...

CVE-2023-48246: Improper Limitation of a Pathname to a Restricted Directory

The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...

CVE-2023-48242: Improper Limitation of a Pathname to a Restricted Directory

The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...