7882 matches found
Path traversal
SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files...
CVE-2023-37288 SmartBPM.NET - Path Traversal
SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files...
CVE-2023-37288 SmartBPM.NET - Path Traversal
SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files...
CVE-2023-37288: Relative Path Traversal
SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files...
CVE-2023-37288
CVE-2023-37288 concerns the SmartBPM.NET component, where a path traversal flaw in the file download function can allow an unauthenticated remote attacker to access arbitrary system files. The description consistently references path traversal in SmartBPM.NET; connected records confirm the issue ...
SmartSoft SmartBPM.NET 路径遍历漏洞
SmartSoft SmartBPM.NET is an enterprise process management platform from China-based SmartSoft. A security vulnerability exists in SmartSoft SmartBPM.NET, which is caused by a path traversal vulnerability in the file download function...
CVE-2023-35934
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...
Design/Logic Flaw
Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint /knowage/restful-services/dossier/importTemplateFile allows authenticated users to download template hosted on the server. However, starting in the 6.x.x branch...
Knowage 路径遍历漏洞
Knowage is an open source suite for modern business analytics on legacy resources and big data systems from Knowage, Italy. A path traversal vulnerability exists in Knowage versions prior to 6.x.x through 8.1.8, which stems from an authenticated user being able to download a template hosted on th...
Arbitrary File Download Vulnerability in ES File Browser of Beijing Xiaoxiong Bowang Technology Co.
ES File Explorer is a powerful and free local and network file manager. ES File Browser has an arbitrary file download vulnerability that can be exploited by attackers to obtain sensitive information...
Bludit Arbitrary File Download
-- coding: utf-8 -- /usr/bin/env python Exploit Title: Bludit 3.13.1 Backup Plugin - Arbitrary File Download Authenticated Date: 2022-07-21 Exploit Author: Antonio Cuomo arkantolo Vendor Homepage: https://www.bludit.com Software Link: https://github.com/bludit/bludit Version: 3.13.1 Tested on:...
StruxureWare Data Center Expert XSS
The vulnerability of the StruxureWare Data Center Exper monitoring system relates to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack at the final download point of a DCE file, by modifying paramete...
Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated) Exploit
-- coding: utf-8 -- /usr/bin/env python Exploit Title: Bludit 3.13.1 Backup Plugin - Arbitrary File Download Authenticated Date: 2022-07-21 Exploit Author: Antonio Cuomo arkantolo Vendor Homepage: https://www.bludit.com Software Link: https://github.com/bludit/bludit Version: 3.13.1 Tested on:...
Advanced ASP Chat 2.0 Database Disclosure
==================================================================================================================================== | Title : Advanced ASP chat 2.0 Database Disclosure Exploit | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 108.032-bit...
Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)
-- coding: utf-8 -- /usr/bin/env python Exploit Title: Bludit 3.13.1 Backup Plugin - Arbitrary File Download Authenticated Date: 2022-07-21 Exploit Author: Antonio Cuomo arkantolo Vendor Homepage: https://www.bludit.com Software Link: https://github.com/bludit/bludit Version: 3.13.1 Tested on:...
3DPrint < 3.5.6.9 - CSRF to arbitrary file downlad
Description The plugin does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into...
Splus Server Arbitrary File Download Execution
The vulnerability of the Splus Server component of the Spotfire Statistics Services software lies in the ability to download unlimited dangerous files. Exploiting this vulnerability allows a malicious actor to download and execute arbitrary files remotely...
Arbitrary File Download Vulnerability in iVMS-8700 Integrated Security Management Platform Software of Hangzhou Hikvision Digital Technology Co.
The iVMS-8700 integrated security management platform software is a life-useful and convenient security software. Hangzhou Hikvision Digital Technology Co., Ltd. iVMS-8700 integrated security management platform software has an arbitrary file download vulnerability that can be exploited by...
Missing Authorization
com.liferay.dynamic.data.mapping.form is vulnerable to Missing Authorization. The vulnerability exists in the dynamic data mapping because it does not limit the document and Media files which can be downloaded from a form, allowing an attacker to download any file from Document and Media via a...