CVE-2016-6848

CVE-2016-6848 affects Open-Xchange OX App Suite prior to 7.8.2-rev8. The issue allows via API requests to inject, generate and download executable files to the client using a Reflected File Download vector. A malicious platform-specific batch file can be created through a trusted domain without a...

CVE-2016-9209

A vulnerability in TCP processing in Cisco FirePOWER system software could allow an unauthenticated, remote attacker to download files that would normally be blocked. Affected Products: The following Cisco products are vulnerable: Adaptive Security Appliance ASA 5500-X Series with FirePOWER...

Cisco FirePOWER Malware Security Bypass Vulnerability

Cisco FirePOWER is a next-generation firewall developed by Cisco. A security bypass vulnerability exists in the Cisco FirePOWER Malware TCP processing, which allows remote attackers to exploit the vulnerability to bypass security restrictions and download files...

Debian DSA-3731-1 : chromium-browser - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2016-5181 A cross-site scripting issue was discovered. - CVE-2016-5182 Giwan Go discovered a heap overflow issue. - CVE-2016-5183 A use-after-free issue was discovered in the pdfium library. - CVE-2016-5184 Another...

Code injection

An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

Debian Security Advisory DSA 3731-1 (chromium-browser - security update)

Several vulnerabilities have been discovered in the chromium web browser. CVE-2016-5181 A cross-site scripting issue was discovered. CVE-2016-5182 Giwan Go discovered a heap overflow issue. CVE-2016-5183 A use-after-free issue was discovered in the pdfium library. CVE-2016-5184 Another...

Cisco FirePOWER Malware Protection Bypass Vulnerability

A vulnerability in TCP processing in Cisco FirePOWER system software could allow an unauthenticated, remote attacker to download files that would normally be blocked. The vulnerability is due to out-of-order TCP segments retransmissions out of the current window, which have already been...

Earcms down.php suffers from arbitrary file download vulnerability

Ear Music Ear Music is an interface using Discuz backend style and UCHome user center style combined with the core by the high-speed template engine and caching mechanism and other frameworks coexist PHP open source music system. Earcms down.php arbitrary file download vulnerability. Allow...

earcms audio.php has an arbitrary file download vulnerability

Ear Music Ear Music is an interface using Discuz background style and UCHome user center style combined with the core by the high-speed template engine and caching mechanism and other frameworks coexist PHP open source music system. earcms audio.php arbitrary file download vulnerability. Allow...

Google Chrome < 55.0.2883.75 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 55.0.2883.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 201612stable-channel-update-for-desktop advisory. - Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75...

Google Chrome < 55.0.2883.75 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 55.0.2883.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 201612stable-channel-update-for-desktop advisory. - Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75...

SIEMENS SICAM PAS Security Bypass Vulnerability (CNVD-2016-11836)

SICAM PAS is an energy automation solution for the operation of substation equipment. It has open communication interfaces for power system control and control of industrial power supply equipment. A security bypass vulnerability exists in SIEMENS SICAM PAS. A remote attacker can exploit the...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application or system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

Ear Music (Ear Music) download.php has an arbitrary file download vulnerability

Ear Music Ear Music is an interface using Discuz background style and UCHome user center style combined with the core by the high-speed template engine and caching mechanism and other frameworks coexist PHP open source music system. Ear Music Ear Music download.php arbitrary file download...

GNU Wget < 1.18 - Access List Bypass / Race Condition

''' ============================================= - Discovered by: Dawid Golunski - dawidatlegalhackers.com - https://legalhackers.com - https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html - CVE-2016-7098 - Release date: 24.11.2016 - Revision 1.0 - Severity:...

U.S. Dept Of Defense: Unrestricted File Download / Path Traversal

A misconfigured USTRANSCOM website allowed arbitrary system files to be downloaded. ziot was able to demonstrate this vulnerability by downloading a file from a specially crafted URL. Thanks ziot!...

File Download Vulnerability in TORS WAS

TRS WAS is a functional presentation platform. A file download vulnerability exists in TORS WAS. Allowing an attacker can download files and obtain sensitive system information...

Arbitrary File Download Vulnerability in Mixcall Attendant Management System File Parameter

Mixcall seat management system is based on B/S architecture, the management personnel can directly log into the Mixcall seat management center through the computer, and view the detailed situation related to the seat personnel's voice services. An arbitrary file download vulnerability exists in t...

Arbitrary File Download Vulnerability in Mixcall Seat Management System record_download Function

Mixcall seat management system is based on B/S architecture, the management personnel can directly log into the Mixcall seat management center through the computer, and view the detailed situation related to the seat personnel's voice services. An arbitrary file download vulnerability exists in t...

SweetRice 1.5.1 - Arbitrary File Download

SweetRice 1.5.1 - Arbitrary File Download /usr/bin/python -- Coding: utf-8 -- Exploit Title: SweetRice 1.5.1 - Local File Inclusion Exploit Author: Ashiyane Digital Security Team Date: 03-11-2016 Vendor: http://www.basic-cms.org/ Software Link:...