7899 matches found
CVE-2022-25216: Improper Limitation of a Pathname to a Restricted Directory
An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player recently renamed PlayerFab has read-access, by means of an HTTP GET request to http:// :32080/download/...
PT-2022-17155
Name of the Vulnerable Software and Affected Versions DVDFab 12 Player recently renamed PlayerFab versions not specified Description An absolute path traversal issue allows a remote attacker to download any file on the Windows file system for which the user account running the software has...
CVE-2020-14112
Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this vulnerability to download part of the files in Xiaomi Router AX6000...
Xiaomi Router AX6000 has a vulnerability related to information leakage
Xiaomi Router AX6000 is a router from Xiaomi China. Xiaomi Router AX6000 1.0.56 previously had an information disclosure vulnerability that stemmed from a routing configuration error, which could be exploited by an attacker to download some of the files in Xiaomi Router AX6000...
Debian DSA-5097-1 : firefox-esr - security update
The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5097 advisory. Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information...
Mageia: Security Advisory (MGASA-2022-0093)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security Vulnerabilities fixed in Thunderbird 91.7 — Mozilla
When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, would lead to JavaScript...
Mozilla Firefox ESR < 91.7
The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-11 advisory. - If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts,...
CVE-2020-14112: Exposure of Sensitive Information to an Unauthorized Actor
Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this vulnerability to download part of the files in Xiaomi Router AX6000...
Backdoor.Win32.BluanWeb Information Disclosure
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/30903ccbc6747c0da5a2775884b78defB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.BluanWeb Vulnerability: Information Disclosure Description: The malware "BlueAngel F...
BossCMS V1.1 Arbitrary File Download Vulnerability in Background
BossCMS is a safe, stable, good, permanent free open source, independent research and development of PHP framework for enterprise building system. BossCMS background arbitrary file download vulnerability, attackers can use the vulnerability to download any file in the server...
WordPress Drag & Drop Contact Form Plugin Arbitrary File Download Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in Wordpress Drag & Drop Contact Form Plugin 1.0.5 and earlier...
CVE-2021-24689
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...
CVE-2021-24689
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...
CVE-2021-24689 Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Admin+ Arbitrary System File Read
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...
WordPress Media Library File Download plugin <= 1.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Media Library File Download plugin versions = 1.0. Solution Update the WordPress Media Library File Download plugin to the latest available version at least 1.1...
PT-2022-9448
Name of the Vulnerable Software and Affected Versions The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin versions 1.0.0 through 1.0.5 Description The issue allows high privilege users to download arbitrary files from the web server via a path traversal attack. Recommendations F...
WordPress Media Library File Download plugin <= 1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Media Library File Download plugin versions = 1.0. Solution Update the WordPress Media Library File Download plugin to the latest available version at least 1.1...
WordPress plugin: Path traversal vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in Wordpress Drag & Drop Contact Form Plugin 1.0.5 and earlier...
CVE-2021-24689: Improper Limitation of a Pathname to a Restricted Directory
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack...