CVE-2020-7814

RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of validation to file extension, witch can used as remote-code-excution attacks by hackers File download & execution vulnerability in COMPONENT of RAONWIZ RAON...

CVE-2020-7815

XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setting the arguments to the vulnerable method. this can be leveraged for code execution. File download vulnerability in COMPONENT of TOBESOFT XPLATFORM allows ATTACKER/ATTACK to caus...

Raonwiz CyMiInstaller322 ActiveX Code Issue Vulnerability

Raonwiz CyMiInstaller322 ActiveX is a version control program from the Korean company Raonwiz. A security vulnerability exists in File Download in Raonwiz CyMiInstaller322 ActiveX 2016.5.26.1 and earlier versions, which stems from the program failing to adequately perform an authentication...

CVE-2019-19161

CyMiInstaller322 ActiveX which runs MIPLATFORM downloads files required to run applications. A vulnerability in downloading files by CyMiInstaller322 ActiveX caused by an attacker to download randomly generated DLL files and MIPLATFORM to load those DLLs due to insufficient verification...

CVE-2020-15026

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

CVE-2020-15026

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

Directory traversal

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

CVE-2020-15026

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

CVE-2020-15026

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

CVE-2020-15026

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

CVE-2020-15026

CVE-2020-15026 affects Bludit 3.12.0, where a directory traversal flaw in backup/plugin.php can be triggered via the /plugin-backup-download?file=../ parameter to enable arbitrary file download. The cited sources describe the vulnerability as a path traversal in the Bludit backup plugin, enabling...

CVE-2020-15026: Improper Limitation of a Pathname to a Restricted Directory

Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/plugin.php...

PT-2020-14127

Name of the Vulnerable Software and Affected Versions Bludit version 3.12.0 Description The issue allows admins to use a directory traversal approach for arbitrary file download via the "backup/plugin.php" file. This can be achieved by exploiting the "/plugin-backup-download?file=../" endpoint...

Code injection

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath...

Arbitrary File Download Vulnerability in Student Work Management Information System of Zhengfang Software Co.

The positive student work management information system, making full use of the human resources of the student work management department, through informationization, digitization, networked office on the students' learning, life, thinking and other aspects of the comprehensive management, to sol...

CVE-2020-5356

Dell PowerProtect Data Manager PPDM versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. A remote authenticated malicious user may download any file from the affected PowerProtect virtual machines...

Shenzhen Police Wing Intelligent Technology Co., Ltd. website building system has arbitrary file download vulnerability

Shenzhen Police Wings Intelligent Technology Co., Ltd. is a leading enterprise in China's law enforcement recorder industry, focusing on providing law enforcement departments with law enforcement recorders as the core, including the Police Wings series of intelligent law enforcement equipment, th...

mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications...

Arbitrary File Download Vulnerability in Website Building System of Beijing Zhongjin Yunchuang Software Co.

Ltd. is a company that has the ability to implement and develop traditional ERP, as well as experience in mobile Internet applications. There is an arbitrary file download vulnerability in the website building system of Beijing Zhongjin Yunchuang Software Co., Ltd, which can be exploited by...

Raonwiz DEXT5 Editor Arbitrary File Download Vulnerability

Raonwiz DEXT5 Editor is an HTML-based Web editor from the Korean company Raonwiz. A security vulnerability exists in the handler/uploadhandler.jsp file in Raonwiz DEXT5 Editor 3.5.1402961 and earlier versions. An attacker can exploit this vulnerability to download arbitrary files with the help of...