PT-2022-19993

Name of the Vulnerable Software and Affected Versions Shopwind versions prior to 3.4.3 Description The issue is related to an Arbitrary File Download vulnerability. It can be exploited via the neirong parameter at the backendcontrollersDbController.php file. Recommendations For versions prior to...

CVE-2022-30058: Improper Limitation of a Pathname to a Restricted Directory

Shopwind =v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at \backend\controllers\DbController.php...

GHSA-64HC-4JX3-62JP Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter

Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter...

Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter

Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter...

Exposure of Sensitive Information to an Unauthorized Actor

Description Attacker can be able to download file from system. Proof of Concept 1.Login as student - Go to GRADES - Assignments - Submit a file to a random assignment - save. 2.Attacker with or without account can be able to download through this URL...

CVE-2021-43930: Improper Limitation of a Pathname to a Restricted Directory

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system...

CVE-2021-46423

Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full configuration file...

CVE-2021-46423

Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full configuration file...

Arbitrary file deletion

Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full configuration file...

CVE-2021-46423

The CVE-2021-46423 entry concerns Telesquare TLR-2005KSH 1.0.0, affected by an unauthenticated file download vulnerability that lets a remote attacker download the full device configuration. Public sources in the connected documents confirm the issue stems from insufficient authentication, enabli...

CVE-2021-46423

Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full configuration file...

Telesquare TLR-2005Ksh security vulnerability

Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from Telesquare Korea. Telesquare TLR-2005Ksh version 1.0.0 is vulnerable to a file download vulnerability that stems from a lack of authentication strength. A remote attacker can exploit this vulnerability to be able to download the complete...

CVE-2021-46423: Undefined Security Weakness

Telesquare TLR-2005KSH 1.0.0 is affected by an unauthenticated file download vulnerability that allows a remote attacker to download a full configuration file...

PT-2022-12699

Name of the Vulnerable Software and Affected Versions Telesquare TLR-2005KSH version 1.0.0 Description The issue allows a remote attacker to download a full configuration file due to an unauthenticated file download vulnerability. Recommendations For Telesquare TLR-2005KSH version 1.0.0, consider...

[SECURITY] Fedora 35 Update: zchunk-1.2.2-1.fc35

zchunk is a compressed file format that splits the file into independent chunks. This allows you to only download the differences when downloading a new version of the file, and also makes zchunk files efficient over rsync. zchunk files are protected with strong checksums to verify that the file...

Denial Of Service (DoS)

asterisk is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization which allows files that are not certificates to be downloaded allowing an attacker to crash the system by making the users download a larger than expected file...

CVE-2022-1119

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the /includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in...

CVE-2022-1119

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the /includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in...

CVE-2021-26625

Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation...

CVE-2021-26625

Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation...