Security feature bypass

A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could explo...

CVE-2019-1877

Cisco Enterprise Chat and Email contains an HTTP API vulnerability in the file-download function due to insufficient authentication, allowing unauthenticated, remote attackers to download files attached in chat sessions. A crafted request to the API can exfiltrate files from other users. Affected...

CVE-2019-1877 Cisco Enterprise Chat and Email Attachment Download Vulnerability

A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could explo...

Security update for chromium, re2 (important)

openSUSE Security Update: Security update for chromium, re2 Announcement ID: openSUSE-SU-2019:2425-1 Rating: important References: 1154806 Cross-References: CVE-2019-13699 CVE-2019-13700 CVE-2019-13701 CVE-2019-13702 CVE-2019-13703 CVE-2019-13704 CVE-2019-13705 CVE-2019-13706 CVE-2019-13707...

Security update for chromium, re2 (important)

openSUSE Security Update: Security update for chromium, re2 Announcement ID: openSUSE-SU-2019:2420-1 Rating: important References: 1154806 Cross-References: CVE-2019-13699 CVE-2019-13700 CVE-2019-13701 CVE-2019-13702 CVE-2019-13703 CVE-2019-13704 CVE-2019-13705 CVE-2019-13706 CVE-2019-13707...

CVE-2010-0749

Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame...

CVE-2010-0749

Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame...

Information disclosure

Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame...

CVE-2010-0749

Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame...

CVE-2010-0749

Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame...

chromium-browser: Multiple file download protection bypass

Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML page...

ham3d 1.1 Information Disclosure / Default Credentials

/ Exploit Title: ham3d Information Processing Script Local File Download & Default Password Vulnerability Exploit Author: Milad Hacking Vendor Homepage : http://www.ham3d.net/ Demo Script Link: http://wensoni.com Version : 1.1 Google Dork : inurl:fa/forgotpass.html Date: 2019-10-25 Tested on: Kal...

Google Chrome Security Updates (stable-channel-update-for-desktop_22-2019-10) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

KLA11588 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code. Below is a complete list of vulnerabilities: 1. Use-after-free vulnerability in media can be exploited to arbitrary code execution; 2. Buffer overrun vulnerability in...

CVE-2019-16986

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. resources\securedownload.php is also affected...

CVE-2019-16986

FusionPBX exposes a path-traversal/download flaw in resource files. Up to v4.5.7, the unsanitized URL parameter f in resources/download.php (and in resources/secure_download.php) lets an attacker download arbitrary files. Affected versions: FusionPBX

CVE-2019-16990

In FusionPBX up to v4.5.7, the file app/musiconhold/musiconhold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname base64 encoded and allows a download of it...

CVE-2019-16990

FusionPBX CVE-2019-16990 affects versions up to 4.5.7. The vulnerability is in music_on_hold.php where an unsanitized URL-derived file parameter (base64-encoded) enables downloading arbitrary pathnames. Core impact is potential exposure of files via crafted requests; exploitation details are not ...

CVE-2019-13665

Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML page...

PHPOK has an arbitrary file download vulnerability

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. PHPOK arbitrary file download vulnerability, attackers can use the vulnerability of any read, download files, access to sensitive information...