CVE-2023-24366

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

CVE-2023-24366: Undefined Security Weakness

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

CVE-2023-27856

In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed...

CVE-2023-27856 Rockwell Automation ThinManager ThinServer Path Traversal Download

In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed...

PT-2023-21376 · Rockwell Automation · Thinmanager Thinserver

Name of the Vulnerable Software and Affected Versions: Rockwell Automation's ThinManager ThinServer affected versions not specified Description: Path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploi...

Rockwell Automation ThinManager 路径遍历漏洞

Rockwell Automation ThinManager is a thin client management software from Rockwell Automation, Inc. It allows thin clients to be assigned to multiple remote desktop servers at the same time. A path traversal vulnerability exists in Rockwell Automation ThinManager ThinServer, which can be exploite...

CVE-2023-27856: Improper Limitation of a Pathname to a Restricted Directory

In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed...

PT-2023-2072

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 111 Description The issue is related to the Intent mechanism in Mozilla Firefox for Android, which can be exploited by a remote attacker to download arbitrary files due to the lack of request execution whe...

Inappropriate Implementation

Google Chrome is vulnerable to Inappropriate Implementation. The vulnerability exists in the iframe Sandbox in the library, which allows an attacker to bypass file download restrictions via a crafted HTML page...

Improper access control

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

CVE-2023-25573 Improper access control to download file in metersphere

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

CVE-2023-25573 Improper access control to download file in metersphere

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

CVE-2023-25573 Improper access control to download file in metersphere

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

CVE-2023-26948

onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download...

CVE-2023-26948

onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download...

Design/Logic Flaw

onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download...

CVE-2023-26948

onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download...

CVE-2023-26948

The CVE-2023-26948 entry affects onekeyadmin v1.3.9, with a disclosed arbitrary file read vulnerability exposed via the /admin1/file/download endpoint. Root cause and impact: Confidentiality impact is HIGH; other impacts are NONE. The CVSS v3.1 score is 7.5 (NETWORK attack vector, LOW attack comp...

CVE-2023-25573: Missing Authorization

metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This...

PT-2023-20172

Name of the Vulnerable Software and Affected Versions metersphere versions prior to 1.20.20 lts metersphere versions prior to 2.7.1 Description metersphere is an open source continuous testing platform. An improper access control issue exists in "/api/jmeter/download/files", which allows any user...