6605 matches found
CVE-2021-33726
CVE-2021-33726 — SINEC NMS path traversal vulnerability in Siemens SINEC NMS prior to version 1.0 SP2 Update 1. The flaw allows downloading arbitrary files under a user-controlled path by failing to ensure the relative path stays within the target directory. Affects all versions
rConfig Information Disclosure Vulnerability (CNVD-2021-99276)
rConfig is an open source network device configuration management utility . An information disclosure vulnerability exists in rConfig version 3.9.6. An attacker can exploit this vulnerability to download any file on the server...
Siemens SINEC NMS 路径遍历漏洞
SINEC NMS is Siemens' network management system for monitoring and managing industrial networks. A path traversal vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1. The vulnerability stems from the fact that the affected system allows arbitrary files to be downloaded under...
rConfig 信息泄露漏洞
rConfig is an open source network device configuration management utility . An information disclosure vulnerability exists in rConfig version 3.9.6. An attacker can exploit this vulnerability to download any file on the server...
Projectsend 安全漏洞
An information disclosure vulnerability exists in ProjectSend version r1295, a free, customer-facing private file sharing web application. The vulnerability stems from the ids parameter in files-edit.php and the id parameter in process.php not checking for authorization. An attacker could exploit...
VulnCheck KEV: CVE-2021-28149
Hongdian H8922 3.0.5 devices allow Directory Traversal. The /logdownload.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ e.g., ../../etc/passwd This can be carried out with a web...
Code injection
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard user interface. IBM X-Force ID: 202213...
CVE-2021-29760
IBM Sterling B2B Integrator Standard Edition versions 5.2.0.0–6.1.1.0 expose an input validation weakness in the dashboard UI that could allow an authenticated user to download unauthorized files. Connected sources (CNVD/CNNVD and IBM bulletin) describe this as an input validation vulnerability a...
Backdoor.Win32.Hupigon.asqx Unauthenticated Open Proxy
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/a344b767d58b6c83b92bb868727e021c.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.asqx Vulnerability: Unauthenticated Open Proxy Description: The malware liste...
GHSA-2RH5-JVGX-PGW3 Any storage file can be downloaded from p.sh if full server path is known
The default configuration for platform.sh .platform.app.yaml allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows...
CVE-2021-37200
A vulnerability has been identified in SINEC NMS All versions V1.0 SP1. An attacker with access to the webserver of an affected system could download arbitrary files from the underlying filesystem by sending a specially crafted HTTP request...
CVE-2021-37200
A vulnerability has been identified in SINEC NMS All versions V1.0 SP1. An attacker with access to the webserver of an affected system could download arbitrary files from the underlying filesystem by sending a specially crafted HTTP request...
CVE-2021-37200
CVE-2021-37200 affects Siemens SINEC NMS versions prior to 1.0 SP1. The vulnerability is a path traversal flaw (improper limitation of a pathname) that could allow an attacker with webserver access to download arbitrary files from the underlying filesystem via a specially crafted HTTP request. Ro...
CVE-2021-37200
A vulnerability has been identified in SINEC NMS All versions V1.0 SP1. An attacker with access to the webserver of an affected system could download arbitrary files from the underlying filesystem by sending a specially crafted HTTP request...
Siemens SINEC NMS 路径遍历漏洞
Siemens SINEC NMS is a network management system NMS from Siemens, Germany, that can be used 24/7 to centrally monitor, manage and configure industrial networks with tens of thousands of devices, including safety-related areas. A path traversal vulnerability exists in Siemens SINEC NMS versions...
TongWEB application server is vulnerable to arbitrary file download
TongWEB Application Server is a standard, secure, highly available and feature-rich enterprise-class application server.TongWEB Application Server is vulnerable to arbitrary file download, which can be exploited by attackers to obtain sensitive information...
The vulnerability of the posteredit.php file in the AikCms content management system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the posteredit.php file in the AikCms content management system is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...
CVE-2020-7874
Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension...
CVE-2021-26608
An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issue is due to missing support for integrity check of download URL or downloaded file hash...
CVE-2020-7874
Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension...