7896 matches found
Denial Of Service (DoS)
parse-server is vulnerable to denial of service. The vulnerability exists in multiple functions due to user inputs not properly validated which allows an attacker to send a file download request with an invalid byte range causing an application crash...
PT-2022-24276 · Esri · Esri Arcgis Server
Name of the Vulnerable Software and Affected Versions: Esri ArcGIS Server affected versions not specified Description: A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services, potentially allowing a remote, unauthenticated attacker to induce an unsuspecting...
CVE-2022-38199: Download of Code Without Integrity Check
A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings...
CVE-2022-39313
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been...
CVE-2022-39313
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been...
CVE-2022-39313 Parse Server crashes when receiving file download request with invalid byte range
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been...
CVE-2022-39313: Improper Validation of Specified Quantity in Input
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been...
Avira Security Privilege Escalation
The vulnerability of Avira Security’s update function is related to the possibility of downloading arbitrary files. Exploiting this vulnerability can allow a hacker to increase their privileges...
parse-server crashes when receiving file download request with invalid byte range
Impact Parse Server crashes when a file download request is received with an invalid byte range. Patches Improved parsing of the range parameter to properly handle invalid range requests. Workarounds None References - GHSA-h423-w6qv-2wj3...
GHSA-H423-W6QV-2WJ3 parse-server crashes when receiving file download request with invalid byte range
Impact Parse Server crashes when a file download request is received with an invalid byte range. Patches Improved parsing of the range parameter to properly handle invalid range requests. Workarounds None References - GHSA-h423-w6qv-2wj3...
PT-2022-24895 · Unknown · Parse Server
Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.17 Parse Server versions prior to 5.2.8 on the 5.x branch Description: The issue occurs when a file download request is received with an invalid byte range, causing the server to crash and resulting in a...
CVE-2021-45789
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function...
CVE-2021-45789
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function...
CVE-2021-45789
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function...
Directory traversal
An issue was discovered in FusionPBX before 4.5.30. The logviewer.php Log View page allows an authenticated user to choose an arbitrary filename for download i.e., not necessarily freeswitch.log in the intended directory...
File Download Vulnerability in EWEB Network Management System of Beijing StarNet Ruijie Network Technology Co.
Ruijie Networks is a specialized network vendor with a full range of network equipment product lines and solutions, including switches, routers, software, security firewalls, wireless products and storage. A file download vulnerability exists in the EWEB network management system of Beijing StarN...
FusionPBX security vulnerabilities
FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conferencing server and voice application server. A security vulnerability exists in FusionPBX versions prior to 4.5.30, which stems from t...
MeterSphere security vulnerabilities
MeterSphere is MeterSphere open source one-stop open source continuous testing platform. MeterSphere v1.15.4 version of a security vulnerability , the vulnerability stems from the existence of arbitrary file read vulnerability , authenticated users can read any file on the server through the file...
WKUserScript Script File Loading
The vulnerability of the WKUserScript script in Mozilla Firefox’s browser download function for iOS is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to download any file they desire...
Active eCommerce CMS 6.3.0 Arbitrary File Download
Exploit Title: Active eCommerce CMS Arbitrary File Download Exploit Author: th3d1gger Vendor Homepage: https://codecanyon.net Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405 Version: Version 6.3.0 Tested on Ubuntu 18.04 without authentication with for loop user can downlo...