CVE-2023-27025

The CVE-2023-27025 entry describes an arbitrary file download vulnerability in the background management module of RuoYi versions 4.7.6 and earlier. The underlying issue is an insecure file download path that allows an attacker to retrieve arbitrary server files. Affected software: RuoYi (backend...

CVE-2023-27025: Download of Code Without Integrity Check

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server...

CVE-2023-27025

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server...

CVE-2023-27025

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server...

CVE-2023-28844

CVE-2023-28844 affects Nextcloud Server; an access-control error allows users who should not download a file to retrieve an older version and distribute it. Affected versions were prior to 24.0.10 and prior to 25.0.4. The issue is mitigated by upgrading to Nextcloud Server 24.0.10 or 25.0.4 (or l...

CVE-2023-28844 User without download rights can download older version of that file in nextcloud server

Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.10 and 25.0.4. Users are advised to...

CVE-2023-28844: Improper Access Control

Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.10 and 25.0.4. Users are advised to...

PT-2023-22002 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud server versions prior to 24.0.10 Nextcloud server versions prior to 25.0.4 Description: The issue affects Nextcloud server, an open source home cloud implementation, where users who should not have download permissions can still...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability exists due to improper access control in handlers.py which allows an attacker to traverse outside the restricted directory and download arbitrary files on the server. Note that mlflow is only affected if it runs with either mlflow server o...

CVE-2022-27644

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files...

CVE-2023-24366

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

CVE-2023-24366

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

Design/Logic Flaw

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

arbitrary file read

Description An authenticated attacker can abuse import-server-files with a path traversal to download an arbitrary file from the server Collaborator: @ub3rsick Proof of Concept 1. 1- to trigger the request for SSRF: go to files - assets - select a folder - right click - add asset - import from...

CVE-2023-24366

CVE-2023-24366 affects rConfig v6.8.0 . The vulnerability is described as an arbitrary file download via a crafted HTTP request, exposing sensitive files and yielding a CONFIDENTIALITY impact: HIGH with no integrity/availability impact. The NVD/CNA entries assign a CVSS v3.1 base score 6.5 (MEDIU...

CVE-2023-24366

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

rConfig 安全漏洞

rConfig is an open source network configuration management utility. A security vulnerability exists in rConfig version v6.8.0, which stems from the presence of an arbitrary file download vulnerability that can be exploited by an attacker to download sensitive files via a crafted HTTP request...

CVE-2023-24366

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

CVE-2023-24366: Undefined Security Weakness

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

CVE-2023-27856

In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed...