CVE-2023-22854

The ccmweb component of Mitel MiContact Center Business server versions 9.2.2.0 through 9.4.1.0 is vulnerable to an arbitrary file download. This is caused by insufficient restriction of URL parameters , which allows an unauthenticated attacker to access sensitive information. As a temporary work...

WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Arbitrary File Download

Software Shortcodes Ultimate Type Plugin Vulnerable versions = 5.12.6 Fixed in 5.12.7 OWASP Top 10 A3: Sensitive Data Exposure Classification Arbitrary File Download CVE CVE-2023-25050 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 547ac1ab598f Credits Rafie Muhammad...

MGASA-2023-0029 Updated ruby-sinatra packages fix security vulnerability

Potential reflected file download RFD vulnerability in ruby-sinatra, a Ruby library for writing HTTP applications. A Content-Disposition HTTP header was being incorrectly derived from a potentially user-supplied filename. CVE-2022-45442...

CVE-2022-44343

CRMEB 4.4.4 is vulnerable to Any File download...

Design/Logic Flaw

CRMEB 4.4.4 is vulnerable to Any File download...

CVE-2022-44343

CRMEB 4.4.4 is vulnerable to Any File download...

PT-2023-14453

Name of the Vulnerable Software and Affected Versions CRMEB version 4.4.4 Description The issue allows for the download of any file, indicating a significant security risk. There is no information provided about the estimated number of potentially affected devices worldwide or details about...

Zhongbang CRMEB 安全漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Xi'an, China. A security vulnerability exists in CRMEB version 4.4.4, which is caused by an arbitrary file download...

CVE-2022-44343: Files or Directories Accessible to External Parties

CRMEB 4.4.4 is vulnerable to Any File download...

CVE-2022-44343

CRMEB 4.4.4 is vulnerable to Any File download...

CVE-2022-44343

CRMEB 4.4.4 is reported vulnerable to an Any File download vulnerability (arbitrary file download). The CVSS 3.1 base score is 7.5 (HIGH) with NETWORK attack vector, LOW complexity, no privileges required, no user interaction, affecting confidentiality. The available documents confirm the issue b...

CVE-2022-44343

CRMEB 4.4.4 is vulnerable to Any File download...

WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to Arbitrary File Download

Software 1003 Mortgage Application Type Plugin Vulnerable versions = 1.75 Fixed in 1.80 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Download CVE CVE-2022-45368 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 541a2fe842ed Credits Rodrigo Escobar...

CVE-2022-48161

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

CVE-2022-48161

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

Design/Logic Flaw

Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request...

EasyImages 安全漏洞

EasyImages is a thin wrapper on PIL by Jakub Cieslik individual developer. It is used for exploring, visualizing and sharing images. A security vulnerability exists in EasyImages version v2.0, which stems from the presence of an arbitrary file download vulnerability that can be exploited by an...

CVE-2022-48161

CVE-2022-48161 affects Easy Images v2.0. An arbitrary file download vulnerability exists in the component /application/down.php, exploitable via a crafted GET request. The issue is mapped with CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base score 7.5, HIGH; network vector, no privileges, no ...

Correos Oficial <= 1.3.0.0 - Unauthenticated Arbitrary File Download

The plugin does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server. PoC Dependency: WooCommerce plugin Use the following curl command to download the contents of the wp-config.php file:...

RHEL 9 : pcs (RHSA-2023:0527)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0527 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: sinatra: Reflected File Downlo...