Code injection

Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests...

SICK APU Security Vulnerability

SICK APU is a railroad analysis system from SICK, Germany. A security vulnerability exists in the SICK APU RDT400 that stems from an arbitrary file download vulnerability. The vulnerability can be exploited by an attacker to download arbitrary files from a server via HTTP requests...

Arbitrary File Download Vulnerability in Yonyou UAP/NC of UFIDA Network Technology Co.

Founded in 1988, UFIDA is a global provider of advanced cloud services, software, and financial services for enterprises and public organizations. An arbitrary file download vulnerability exists in Yonyou UAP/NC, which can be exploited by attackers to obtain sensitive information...

PT-2023-28914

Name of the Vulnerable Software and Affected Versions SICK APU affected versions not specified Description The issue allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the "FTP server". Recommendations At the moment, there is no informatio...

CVE-2023-5101: Files or Directories Accessible to External Parties

Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests...

SICK APU Code Issue Vulnerability

SICK APU is a railroad analysis system from SICK, Germany. A security vulnerability exists in SICK APU that stems from an improper access control vulnerability. The vulnerability can be exploited by an attacker to download files and upload arbitrary files via anonymous access to an FTP server...

CVE-2023-43696: Improper Access Control

Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP server...

Rocky Linux 8 : firefox (RLSA-2023:4952)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:4952 advisory. - A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing...

CVE-2023-3512

Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter...

PT-2023-25151 · Unknown · Conacwin Cb

Name of the Vulnerable Software and Affected Versions: ConacWin CB versions 3.8.2.2 and earlier Description: The issue is a relative path traversal vulnerability that could allow an attacker to perform an arbitrary download of files from the system via the Download file parameter. Recommendations...

Setelsa Security ConacWin CB Path Traversal Vulnerability

Setelsa Security ConacWin CB is an application from Setelsa Security. A path traversal vulnerability exists in Setelsa Security ConacWin CB 3.8.2.2 and earlier versions, which can be exploited by an attacker to perform an arbitrary file download from the system via the Download file parameter...

CVE-2023-3512: Relative Path Traversal

Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter...

CVE-2023-3349: Exposure of Sensitive Information to an Unauthorized Actor

Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as usernames, IP addresses or SQL queries sent to the application. By accessing the URL /RPS2019Service/status.html, the application enables th...

D-Link Router Uploadfile Arbitrary Command Execution

The vulnerability of the /Tool/uploadfile.php script in D-Link’s DAR-8000 and DAR-7000 router microprogramming systems relates to the ability to download files of a malicious nature without limitation. Exploiting this vulnerability could allow an attacker to execute arbitrary commands remotely...

CVE-2023-36851

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauthoperation.php that doesn't require authentication, an...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-006)

The version of firefox installed on the remote host is prior to 102.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-006 advisory. The Mozilla Foundation describes this issue as follows:Unexpected data returned from the Safe Browsing API could...

CVE-2023-36851 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauthoperation.php that doesn't require authentication, an...

CVE-2023-36851 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauthoperation.php that doesn't require authentication, an...

PT-2023-14670

Name of the Vulnerable Software and Affected Versions M4 PDF plugin for Prestashop sites versions 3.2.3 and before Description The issue is related to a directory traversal vulnerability. The f parameter is not properly checked in the resource "/m4pdf/pdf.php", allowing an attacker to download an...

Prestashop Path Traversal Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The program provides a variety of payment methods, short message alerts and product image zoom and other features. Prestashop plugin M4 PDF 3.2.3 and previous versions of a security vulnerability , the...