CVE-2022-25389

CVE-2022-25389 affects the DCN Firewall DCME-520. Multiple connected sources describe an arbitrary file download vulnerability that can be triggered via the path parameter in /audit/log/log_management.php. The issue’s exploitation details are limited to this path parameter; no additional exploit ...

CVE-2022-25389

DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/logmanagement.php...

Information Exposure in Apache Tapestry

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to...

PT-2022-17254

Name of the Vulnerable Software and Affected Versions DCN Firewall DCME-520 Description The issue is related to an arbitrary file download vulnerability. This vulnerability can be exploited via the path parameter in the file /audit/log/log management.php. Recommendations For DCN Firewall DCME-520...

DCN Firewall DCME-520 security vulnerability

DCN Firewall DCME-520 is a new generation of high-performance security gateway with multi-core high performance from China Cloud Technology DCN. It has excellent performance and powerful data processing capabilities. A security vulnerability exists in the DCN Firewall DCME-520, which originates...

CVE-2022-25389: Undefined Security Weakness

DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/logmanagement.php...

WordPress Download Monitor plugin arbitrary file download vulnerability

WordPress is a blogging platform developed using the PHP language. File Upload is a file upload plugin used in it. WordPress plugin is an application plugin. WordPress Download Monitor plugin version 4.4.6 and previous versions are vulnerable to arbitrary file download. stems from the fact that t...

Arbitrary File Download Vulnerability in TongWeb of Beijing Oriental Technology Co.

TongWeb is an application server from Beijing Orientop Technology Co. Ltd. TongWeb suffers from an arbitrary file download vulnerability that can be exploited by an attacker to obtain sensitive files on the server...

Denial Of Service (DoS)

nicotine-plus is vulnerable to denial of service. The fileisshared function of shares.py does not properly handle invalid file paths in the file download requests, allowing an attacker to crash the application by providing null characters to the file path...

GHSA-P4V2-R99V-WJC2 Nicotine+ DoS on Null Character in Download Request

Denial of service DoS vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character...

py-nicotine-plus -- Denial of service vulnerability

ztauras reports: Denial of service DoS vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character...

CVE-2021-45848

Denial of service DoS vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character...

CVE-2021-45848

Nicotine+ DoS (CVE-2021-45848): A vulnerability in Nicotine+ 3.0.3 and later allows a modified Soulseek client to crash the application by sending a download request with a file path containing a null character. Root cause is insufficient validation of file paths in download requests. Public sour...

SUSE SLED15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2022:0821-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0821-1 advisory. Firefox Extended Support Release 91.7.0 ESR bsc1196900: - CVE-2022-26383: Browser window spoof using fullscree...

Mozilla Thunderbird < 91.7

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-12 advisory. - If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts,...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2022:0822-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0822-1 advisory. Firefox Extended Support Release 91.7.0 ESR bsc1196900: - CVE-2022-26383: Browser window spoof using fullscreen mode -...

CVE-2021-24692

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2021-24692 Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2021-24692

The CVE concerns the WordPress plugin Simple Download Monitor (before 3.9.5). Affected component: the plugin’s access control/file serving logic allows users with roles as low as Contributor to download arbitrary files from the web server (e.g., wp-config.php) via a path traversal vector. Root ca...

CVE-2021-24692: Improper Limitation of a Pathname to a Restricted Directory

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...