All-in-One Video Gallery 2.5.8 - 2.6.0 - Unauthenticated Arbitrary File Download & SSRF

The plugin does not validate the dl parameter which could allow unauthenticated users to download arbitrary files from the server, as well as perform SSRF attacks...

Reflected File Download (RFD)

ktor-http is vulnerable to reflected file download attacks. The vulnerability exists because the Content-Disposition filename parameter is not properly encoded which allows an attacker to perform untrusted file downloads...

Arbitrary File Download Vulnerability in Huatian Power Collaboration Office System

Dalian Huatian Software Co., Ltd. is an OA software and solution provider. An arbitrary file download vulnerability exists in Huatian Power Collaboration Office System, which can be exploited by attackers to obtain sensitive information...

MGASA-2022-0281 Updated python-django packages fix security vulnerability

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...

Updated python-django packages fix security vulnerability

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...

GHSA-V866-GWF5-W92F JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack

JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack...

CVE-2022-38179

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

CVE-2022-38179

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

Design/Logic Flaw

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

CVE-2022-38179

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

CVE-2022-38179

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

CVE-2022-38179

JetBrains Ktor prior to 2.1.0 is affected by a Reflect File Download (RFD) vulnerability. The issue stems from improper encoding of the Content-Disposition filename parameter, enabling an attacker to trigger untrusted file downloads. Multiple sources confirm the affected product/version and descr...

CVE-2022-38179

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

PT-2022-24259 · Jetbrains · Jetbrains Ktor

Name of the Vulnerable Software and Affected Versions: JetBrains Ktor versions prior to 2.1.0 Description: The issue concerns a Reflect File Download attack. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this...

JetBrains Ktor framework security vulnerabilities

JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A security vulnerability exists in JetBrains Ktor framework versions prior to 2.1.0, which stems from vulnerability to reflected file download attacks...

CVE-2022-38179: Incomplete List of Disallowed Inputs

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack...

GHSA-PCJH-6R5H-R92R django-sendfile2 before 0.7.0 contains reflected file download vulnerability

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of...

django-sendfile2 before 0.7.0 contains reflected file download vulnerability

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of...

GHSA-8X94-HMJH-97HQ Django vulnerable to Reflected File Download attack

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...

Simple E-Learning System Arbitrary File Download Vulnerability

Simple E-Learning System is a simple e-learning system by Carlo Montero's personal developer. simple E-Learning System is vulnerable to an arbitrary file download vulnerability, which stems from a lack of validation of external input data in the downloadFiles.php parameter download. validation. A...