CVE-2020-7850

The CVE-2020-7850 entry concerns the NBBDownloader.ocx ActiveX control in Groupware. Descriptions across sources indicate a vulnerability that allows remote files to be downloaded and executed by manipulating arguments to the ActiveX method, enabling a remote attacker to lure a user to a crafted ...

Novel Boutique House-plus 3.5.1 - Arbitrary File Download Vulnerability

Exploit Title: Novel Boutique House-plus 3.5.1 - Arbitrary File Download Exploit Author: tuyiqiang Vendor Homepage: https://xiongxyang.gitee.io/ Software Link: https://gitee.com/noveldevteam/novel-plus,https://github.com/201206030/novel-plus Version: all Tested on: linux Vulnerable code:...

Novel Boutique House-plus 3.5.1 Arbitrary File Download

Exploit Title: Novel Boutique House-plus 3.5.1 - Arbitrary File Download Date: 27/03/2021 Exploit Author: tuyiqiang Vendor Homepage: https://xiongxyang.gitee.io/ Software Link: https://gitee.com/noveldevteam/novel-plus,https://github.com/201206030/novel-plus Version: all Tested on: linux Vulnerab...

Novel Boutique House-plus 3.5.1 - Arbitrary File Download

Exploit Title: Novel Boutique House-plus 3.5.1 - Arbitrary File Download Date: 27/03/2021 Exploit Author: tuyiqiang Vendor Homepage: https://xiongxyang.gitee.io/ Software Link: https://gitee.com/noveldevteam/novel-plus,https://github.com/201206030/novel-plus Version: all Tested on: linux Vulnerab...

Arbitrary File Download Vulnerability in SCMS

SCMS is the underlying engine of a secure content management system. SCMS suffers from an arbitrary file download vulnerability that can be exploited by an attacker to obtain sensitive information...

Atlassian JIRA Data Center injection vulnerability

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is a server version of a defect tracking management system. Atlassian JIRA Data Center is the data center version of Atlassian JIRA, which is an information disclosure vulnerability...

Apache Ambari Arbitrary File Download Vulnerability

Apache Ambari is a web-based tool that supports provisioning, management and monitoring of Apache Hadoop clusters. An arbitrary file download vulnerability exists in Apache Ambari 2.6.2.2 and earlier versions. An attacker can exploit this vulnerability by constructing filenames to traverse other...

CVE-2020-13924

In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files...

CVE-2020-13924

In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files...

Directory traversal

In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files...

CVE-2020-13924

CVE-2020-13924 affects Apache Ambari 2.6.2.2 and earlier. Malicious users can construct file names to perform directory traversal and traverse to other directories to download files, enabling a remote, unauthenticated file download vulnerability. The vulnerability is documented across multiple so...

CVE-2020-13924

In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files...

CVE-2020-13924: Improper Limitation of a Pathname to a Restricted Directory

In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files...

HPESBNW04100 rev.4 - Aruba Instant (IAP), Multiple Vulnerabilities

Potential Security Impact: Local: Authentication Bypass; Remote: Arbitrary File Download, Arbitrary File Modification, Code Execution, Cross-Site Scripting XSS, Denial of Service DoS, Execution of Arbitrary Commands, Unauthenticated Arbitrary Code Execution, Unauthorized Disclosure of Information...

Apache Ambari path traversal vulnerability

Apache Ambari is a web-based tool that supports provisioning, management and monitoring of Apache Hadoop clusters. An arbitrary file download vulnerability exists in Apache Ambari 2.6.2.2 and earlier versions. An attacker can exploit this vulnerability by constructing filenames to traverse other...

Design/Logic Flaw

It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue...

CVE-2019-3897

CVE-2019-3897 affects Red Hat Certification 6 and 7. Affected component: /var/www/rhcert exposure allowing an unauthorized user to download any file by knowing its name. Root cause details are not provided in the available documents, but CVSS metrics indicate remote access with no authentication ...

PT-2021-9110

Name of the Vulnerable Software and Affected Versions Red Hat Certification versions 6 and 7 Description It has been discovered that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Recommendations For Red Hat Certification version 6, restrict access...

Arbitrary File Download Vulnerability in WiseStar Universal Collection Management System

Huixing Software Technology Co., Ltd. specializes in the development of software for the water industry. It has developed a series of management software for the water industry: Huixing Water Charge Management System, Huixing Water Business Management Information System, Huixing Water Expansion a...

Red Hat security vulnerabilities

Red Hat is an operating system from the American company Red Hat, Inc. It provides an open source operating system. A security vulnerability exists in Red Hat 6 and 7 that allows any unauthorized user to download any file under /var/www/rhcert...