7896 matches found
CVE-2022-2357
The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...
CVE-2022-2357
The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...
CVE-2022-2357
The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...
Remote file inclusion
The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...
Design/Logic Flaw
The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation...
CVE-2022-2357 WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download
The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...
CVE-2022-2357
The CVE-2022-2357 entry concerns the WordPress WSM Downloader plugin (versions 1.4.0 and earlier). The vulnerability resides in the pluginās remote file download feature, enabling unauthenticated access to download local files (including wp-config.php). This is an unauthenticated arbitrary-file-d...
Simple E-Learning System security vulnerabilities
Simple E-Learning System is a simple e-learning system by Carlo Montero's personal developer. simple E-Learning System is vulnerable to an arbitrary file download vulnerability, which stems from a lack of validation of external input data in the downloadFiles.php parameter download. validation. A...
WordPress Plugin WSM Downloader has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2022-16086 Ā· WordPress Ā· Wsm Downloader
Name of the Vulnerable Software and Affected Versions: WSM Downloader WordPress plugin versions 1.4.0 and earlier Description: The issue allows any visitor to use the remote file download feature of the WSM Downloader WordPress plugin to download local files, including sensitive ones like...
CVE-2022-2357: Files or Directories Accessible to External Parties
The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php...
Ubuntu 20.04 LTS / 22.04 LTS : Django vulnerability (USN-5549-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5549-1 advisory. It was discovered that Django incorrectly handled certain FileResponse. An attacker could possibly use this issue to expose sensitive information or...
FreeBSD : Django -- multiple vulnerabilities (3b47104f-1461-11ed-a0c5-080027240888)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3b47104f-1461-11ed-a0c5-080027240888 advisory. - An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before...
CVE-2022-36359
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...
Input validation
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...
UBUNTU-CVE-2022-36359
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...
CVE-2022-36359
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...
CVE-2022-27617
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors...
CVE-2022-27617
Synology Calendar's webapi component contains a Path Traversal vulnerability (CVE-2022-27617) affecting versions prior to 2.3.4-0631. The issue stems from an improper limitation of a pathname to a restricted directory, allowing remote authenticated users to download arbitrary files via unspecifie...
CVE-2022-36359
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input...