GHSA-V866-GWF5-W92F JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack

JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack...

CVE-2022-38179

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

CVE-2022-38179

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

Design/Logic Flaw

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

CVE-2022-38179

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

CVE-2022-38179

JetBrains Ktor prior to 2.1.0 is affected by a Reflect File Download (RFD) vulnerability. The issue stems from improper encoding of the Content-Disposition filename parameter, enabling an attacker to trigger untrusted file downloads. Multiple sources confirm the affected product/version and descr...

CVE-2022-38179

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

JetBrains Ktor framework 安全漏洞

JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A security vulnerability exists in JetBrains Ktor framework versions prior to 2.1.0, which stems from vulnerability to reflected file download attacks...

PT-2022-24259 · Jetbrains · Jetbrains Ktor

Name of the Vulnerable Software and Affected Versions: JetBrains Ktor versions prior to 2.1.0 Description: The issue concerns a Reflect File Download attack. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this...

GHSA-PCJH-6R5H-R92R django-sendfile2 before 0.7.0 contains reflected file download vulnerability

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of...

django-sendfile2 before 0.7.0 contains reflected file download vulnerability

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of...

GHSA-8X94-HMJH-97HQ Django vulnerable to Reflected File Download attack

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...

Simple E-Learning System Arbitrary File Download Vulnerability

Simple E-Learning System is a simple e-learning system by Carlo Montero's personal developer. simple E-Learning System is vulnerable to an arbitrary file download vulnerability, which stems from a lack of validation of external input data in the downloadFiles.php parameter download. validation. A...

CVE-2022-2357

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...

CVE-2022-2357

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...

CVE-2022-2357

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...

Remote file inclusion

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...

Design/Logic Flaw

The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation...

CVE-2022-2357

The CVE-2022-2357 entry concerns the WordPress WSM Downloader plugin (versions 1.4.0 and earlier). The vulnerability resides in the plugin’s remote file download feature, enabling unauthenticated access to download local files (including wp-config.php). This is an unauthenticated arbitrary-file-d...

CVE-2022-2357 WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...