CVE-2021-31567 WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability

Authenticated admin+ Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin versions = 4.4.6. The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadablefileurls0 parameter data. It's also...

WordPress Download Monitor 信息泄露漏洞

WordPress is a blogging platform developed using the PHP language. File Upload is a file upload plugin used in it. WordPress plugin is an application plugin. WordPress Download Monitor plugin version 4.4.6 and previous versions are vulnerable to arbitrary file download. stems from the fact that t...

Mageia: Security Advisory (MGASA-2017-0429)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-22828

An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string...

Design/Logic Flaw

An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string...

CVE-2022-22828

An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string...

CVE-2022-22828

Synametrics SynaMan prior to version 5.0 is affected by CVE-2022-22828 due to an insecure direct object reference in the file-download URL. An attacker can access unshared files by modifying the base64-encoded filename string, enabling remote file disclosure. The vulnerability is exposed via the ...

Improper Authorization in liukuo362573/yishaadmin

Description When downloading files using the /admin/File/DownloadFile?filePath= URI, you're able to download any file you want, as long as you know the path of the file, even as an unauthenticated user. This means that an unauthenticated user could download the /etc/passwd/ file or any file that...

WordPress 安全漏洞

WordPress plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin Import Export plugin that stems from a missing function check in the download function wpieprocessfiledownload in the /includes/classes/class-wpie-general.php file. An...

CVE-2022-22531

The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to run arbitrary script code, resulting in sensitive information being disclosed or modified...

CVE-2022-22054

ASUS RT-AX56U’s login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows an unauthenticated local area network attacker to access restricted system paths and download arbitrary files...

PT-2022-15500 · Sap · Sap S/4Hana

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA versions 100 through 106 Description: The F0743 Create Single Payment application does not check uploaded or downloaded files, allowing an attacker with basic user rights to inject dangerous content or malicious code. This could...

CVE-2021-35500 TIBCO Data Virtualization Arbitrary File Download vulnerability

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local acces...

CVE-2021-35500

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local acces...

Tibco Data Virtualization 信息泄露漏洞

Tibco Data Virtualization is a data virtualization platform from Tibco, USA. An information disclosure vulnerability exists in TIBCO Data Virtualization Server because the product does not add permission restrictions to the file download feature. The vulnerability can be exploited to download...

CVE-2021-44586

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information...

CVE-2021-44586

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information...

Arbitrary file deletion

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information...

CVE-2021-44586

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information...

CVE-2021-44586

CVE-2021-44586 concerns dst-admin v1.3.0, where an unauthorized arbitrary file download vulnerability can expose sensitive information. According to NVD, the issue has a Network attack vector with low complexity and no authentication required, exposing partial confidentiality (C:P) and no integri...