CVE-2022-25389

DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/logmanagement.php...

CVE-2022-25389

CVE-2022-25389 affects the DCN Firewall DCME-520. Multiple connected sources describe an arbitrary file download vulnerability that can be triggered via the path parameter in /audit/log/log_management.php. The issue’s exploitation details are limited to this path parameter; no additional exploit ...

CVE-2022-25389

DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/logmanagement.php...

Information Exposure in Apache Tapestry

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to...

DCN Firewall DCME-520 安全漏洞

DCN Firewall DCME-520 is a new generation of high-performance security gateway with multi-core high performance from China Cloud Technology DCN. It has excellent performance and powerful data processing capabilities. A security vulnerability exists in the DCN Firewall DCME-520, which originates...

WordPress Download Monitor plugin arbitrary file download vulnerability

WordPress is a blogging platform developed using the PHP language. File Upload is a file upload plugin used in it. WordPress plugin is an application plugin. WordPress Download Monitor plugin version 4.4.6 and previous versions are vulnerable to arbitrary file download. stems from the fact that t...

Arbitrary File Download Vulnerability in TongWeb of Beijing Oriental Technology Co.

TongWeb is an application server from Beijing Orientop Technology Co. Ltd. TongWeb suffers from an arbitrary file download vulnerability that can be exploited by an attacker to obtain sensitive files on the server...

Denial Of Service (DoS)

nicotine-plus is vulnerable to denial of service. The fileisshared function of shares.py does not properly handle invalid file paths in the file download requests, allowing an attacker to crash the application by providing null characters to the file path...

GHSA-P4V2-R99V-WJC2 Nicotine+ DoS on Null Character in Download Request

Denial of service DoS vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character...

py-nicotine-plus -- Denial of service vulnerability

ztauras reports: Denial of service DoS vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character...

CVE-2021-45848

Denial of service DoS vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character...

SUSE SLED15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2022:0821-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0821-1 advisory. Firefox Extended Support Release 91.7.0 ESR bsc1196900: - CVE-2022-26383: Browser window spoof using fullscree...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2022:0822-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0822-1 advisory. Firefox Extended Support Release 91.7.0 ESR bsc1196900: - CVE-2022-26383: Browser window spoof using fullscreen mode -...

Mozilla Thunderbird < 91.7

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-12 advisory. - If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts,...

CVE-2021-45848

Nicotine+ DoS (CVE-2021-45848): A vulnerability in Nicotine+ 3.0.3 and later allows a modified Soulseek client to crash the application by sending a download request with a file path containing a null character. Root cause is insufficient validation of file paths in download requests. Public sour...

CVE-2021-24692

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2021-24692 Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2021-24692

The CVE concerns the WordPress plugin Simple Download Monitor (before 3.9.5). Affected component: the plugin’s access control/file serving logic allows users with roles as low as Contributor to download arbitrary files from the web server (e.g., wp-config.php) via a path traversal vector. Root ca...

CVE-2020-14112

Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this vulnerability to download part of the files in Xiaomi Router AX6000...

Xiaomi Router AX6000 信息泄露漏洞

Xiaomi Router AX6000 is a router from Xiaomi China. Xiaomi Router AX6000 1.0.56 previously had an information disclosure vulnerability that stemmed from a routing configuration error, which could be exploited by an attacker to download some of the files in Xiaomi Router AX6000...