7899 matches found
CVE-2022-25104
HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/...
CVE-2022-25104
HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/...
CVE-2022-25104
HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/...
HorizontCMS security vulnerabilities
HorizontCMS is a customer relationship management web platform for individual developers. A security vulnerability exists in HorizontCMS, which was discovered to contain an arbitrary file download vulnerability via the /admin/file-manager/ component...
CVE-2022-25104
HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/...
CVE-2022-25104
HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/...
CVE-2022-25104
CVE-2022-25104 affects HorizontCMS v1.0.0-beta.2, where an arbitrary file download vulnerability exists via the /admin/file-manager/ component. The available sources consistently describe the issue as an arbitrary file download, but do not provide concrete details on the exact root cause, impacte...
PT-2022-17079
Name of the Vulnerable Software and Affected Versions HorizontCMS version 1.0.0-beta.2 Description The issue allows for an arbitrary file download via the /admin/file-manager/ component. Recommendations For version 1.0.0-beta.2, consider restricting access to the /admin/file-manager/ component...
CVE-2022-25104: Files or Directories Accessible to External Parties
HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/...
Improper Access Control in alanaktion/phproject
Description The application has a vulnerability that allows anonymous users to download files on the server. In addition, when authenticated user deletes a file in an issue, the file is only unlinked, not completely deleted on the server. That results in anonymous users being able to download the...
WordPress Download Monitor Plugin < 4.4.7 Multiple Vulnerabilities
The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
CVE-2021-25004
The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin...
CVE-2021-25004 SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download
The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin...
CVE-2021-25004
The CVE-2021-25004 entry concerns WordPress plugin SEUR Oficial (versions before 1.7.2). The vulnerability arises from the plugin creating a PHP file with a random name used for support, which enables an authenticated attacker to download arbitrary files from the web server when given the URL and...
WordPress Plugin SEUR Official Access Control Vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. an access control error vulnerability exists i...
PT-2022-9561
Name of the Vulnerable Software and Affected Versions SEUR Oficial WordPress plugin versions prior to 1.7.2 Description The issue allows downloading any file from the web server without restriction after knowing the URL and a password that an administrator can see in the plugin settings page. Thi...
CVE-2021-29395
Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application...
CVE-2021-29395
Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application...