CVE-2022-31739: External Control of File Name or Path

When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%. This bug only affects Firefox for Windows. Other operating systems are unaffected.. Thi...

CVE-2022-45415

When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that extension, leading to possible system compromise if the downloaded file was later ran. This vulnerability affects Firefox 107...

CVE-2022-4108

The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to for example in multisite...

CVE-2022-4107

The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server...

CVE-2022-4106

The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server...

Design/Logic Flaw

The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server...

CVE-2022-4106

The Wholesale Market for WooCommerce WordPress plugin (pre-1.0.7) exposes an unauthenticated arbitrary-file-download vulnerability due to missing authorization checks and improper handling of user input when building system paths. Impact is configured as high (C:H) for confidentiality with no int...

CVE-2022-4106 Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download

The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server...

CVE-2022-4106 Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download

The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server...

CVE-2022-4107 SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File Download

The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server...

CVE-2022-4107 SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File Download

The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server...

CVE-2022-4107

The CVE-2022-4107 issue affects the WordPress SMSA Shipping for WooCommerce plugin prior to version 1.0.5. Affected functionality allows authenticated users (e.g., subscribers) to download arbitrary server files due to missing authorization checks, CSRF protection, and file validation. Consequenc...

CVE-2022-4108 Wholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File Download

The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to for example in multisite...

CVE-2022-4108 Wholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File Download

The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to for example in multisite...

PT-2022-25658

Name of the Vulnerable Software and Affected Versions The Wholesale Market for WooCommerce WordPress plugin version 1.0.7 and earlier Description The issue allows high privilege users, such as admin, to download arbitrary files from the server, even when they should not be able to, for example in...

CVE-2022-4107: Undefined Security Weakness

The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server...

CVE-2022-4108: Undefined Security Weakness

The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to for example in multisite...

PT-2022-25657 · WordPress · Smsa Shipping For Woocommerce

Name of the Vulnerable Software and Affected Versions: SMSA Shipping for WooCommerce WordPress plugin versions prior to 1.0.5 Description: The issue allows any authenticated users, such as subscribers, to download arbitrary files from the server due to a lack of authorization, proper CSRF checks,...

PT-2022-25656 · WordPress · Wholesale Market For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Wholesale Market for WooCommerce WordPress plugin versions prior to 1.0.7 Description: The issue allows unauthenticated attackers to download arbitrary files from the server due to the lack of authorization checks and validation of user...

WordPress plugin Wholesale Market for WooCommerce has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...