7899 matches found
Input validation
Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation...
Design/Logic Flaw
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the /includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in...
CVE-2022-1119
The CVE-2022-1119 issue affects WordPress Simple File List plugin versions up to 3.2.7. It is caused by missing input validation in ee-downloader.php (eeFile parameter), enabling unauthenticated arbitrary file download/read of server files. A local-file-download/LFI is the documented impact. Reme...
CVE-2022-1119 Simple File List <= 3.2.7 - Arbitrary File Download
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the /includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in...
CVE-2021-26625 tobesoft Nexacro arbitrary file download vulnerability
Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation...
CVE-2021-26625
The CVE-2021-26625 entry concerns the Nexacro platform (Tobesoft Nexacro). The root cause is an automatic update feature that does not verify input data beyond version information, enabling a remote attacker to download and execute arbitrary malicious files. Public details specify Nexacro/17.x va...
PT-2022-13669 · WordPress · Simple File List
Name of the Vulnerable Software and Affected Versions: Simple File List WordPress plugin versions up to and including 3.2.7 Description: The issue allows unauthenticated attackers to download arbitrary files due to missing controls in the eeFile parameter found in the /includes/ee-downloader.php...
PT-2022-9774
Name of the Vulnerable Software and Affected Versions Nexacro platform affected versions not specified Description The issue is related to insufficient verification of input data, which can lead to arbitrary file download and execution. This is caused by an automatic update function that fails to...
CVE-2022-1119: Improper Limitation of a Pathname to a Restricted Directory
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the /includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in...
WordPress Plugin “The Simple File List” – Path traversal vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in...
CVE-2022-1119
The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the /includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in...
CVE-2021-26625: Insufficient Verification of Data Authenticity
Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation...
CVE-2022-26498
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2...
Siemens A8000 CP-8050/CP-8031 SICAM WEB Missing File Download / Missing Authentication
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Missing Authentication at File Download & Denial of Service product: Siemens A8000 CP-8050/CP-8031 SICAM WEB vulnerable version: SICAM WEB Version 05.80 / Firmware Packag...
CVE-2022-26498: Uncontrolled Resource Consumption
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2...
CVE-2022-26498
An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2...
Asterisk -- multiple vulnerabilities
The Asterisk project reports: AST-2022-001 - When using STIR/SHAKEN, its possible to download files that are not certificates. These files could be much larger than what you would expect to download. AST-2022-002 - When using STIR/SHAKEN, its possible to send arbitrary requests like GET to...
CVE-2022-27480
A vulnerability has been identified in SICAM A8000 CP-8031 All versions V4.80, SICAM A8000 CP-8050 All versions V4.80. Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files...
CVE-2022-27480
A vulnerability has been identified in SICAM A8000 CP-8031 All versions V4.80, SICAM A8000 CP-8050 All versions V4.80. Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files...
CVE-2022-27480: Missing Authorization
A vulnerability has been identified in SICAM A8000 CP-8031 All versions V4.80, SICAM A8000 CP-8050 All versions V4.80. Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files...