Arbitrary File Download Vulnerability in Visualized Smart Campus

Visualized smart campus is based on the physical environment of the campus, taking the real campus as a whole as a blueprint, using network technology, completing the construction of the visualization of the campus geographic information system, realizing the campus multi-dimensional virtual...

WordPress Duplicator Plugin Arbitrary File Download

An arbitrary file download vulnerability exists in WordPress Duplicator plugin. Successful exploitation of this vulnerability would allow a remote attacker to download arbitrary files from the affected system...

Arbitrary File Download Vulnerability in ZrLog V2.1.1

ZrLog is a blogging program developed using Java. ZrLog V2.1.1 suffers from an arbitrary file download vulnerability, which can be exploited by an attacker to download any file on the server via a constructed path...

Active Attacks Target Popular Duplicator WordPress Plugin

Active exploits are targeting a recently patched flaw in the popular WordPress plugin Duplicator, which has more than 1 million active installations. So far, researchers have seen 60,000 attempts to harvest sensitive information from victims. Researchers at Wordfence who discovered the in-the-wil...

WordPress Plugin 'Duplicator' < 1.3.28 Unauthenticated Arbitrary File Download

The WordPress application running on the remote host has a version of the 'Duplicator' plugin that is prior to 1.3.28 and, thus, is affected by an unauthenticated arbitrary file download vulnerability that can allow the attackers to download 'wp-config.php' and steal database credentials. C Tenab...

Duplicator Plugin for WordPress < 1.3.28 Arbitrary File Download

The WordPress Duplicator Plugin installed on the remote host is affected by an unauthenticated arbitrary file download vulnerability due to improper access controls. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number...

WordPress Duplicator plugin <= 1.3.26 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability found in the WordPress Duplicator plugin versions = 1.3.26. Solution Update the WordPress Duplicator plugin to the latest available version at least 1.3.28...

Duplicator 1.3.24 & 1.3.26 - Unauthenticated Arbitrary File Download

The issue is being actively exploited, and allows attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two versions v1.3.24 and v1.3.26, the vulnerability wasn't present in versions 1.3.22 and before...

Duplicator 1.3.24 & 1.3.26 - Unauthenticated Arbitrary File Download

The issue is being actively exploited, and allows attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two versions v1.3.24 and v1.3.26, the vulnerability wasn't present in versions 1.3.22 and before. PoC...

CVE-2020-1853

GaussDB 200 with version of 6.5.1 have a path traversal vulnerability. Due to insufficient input path validation, an authenticated attacker can traverse directories and download files to a specific directory. Successful exploit may cause information leakage...

Spring Framework Vulnerability - CVE-2020-5398

h3. Issue Summary Security vulnerability scan gave a red flag for Spring Framework plugin version that is used in Bitbucket Server version 6.10.0. The CVE-2020-5398 is being noted from the report scan. h3. Description Plugin: Spring Framework 5.0.x 5.0.16 / 5.1.x 5.1.13 / 5.2.x 5.2.3 Spring...

Spring Framework Vulnerability - CVE-2020-5398

h3. Issue Summary Security vulnerability scan gave a red flag for Spring Framework plugin version that is used in Bitbucket Server version 6.10.0. The CVE-2020-5398 is being noted from the report scan. h3. Description Plugin: Spring Framework 5.0.x 5.0.16 / 5.1.x 5.1.13 / 5.2.x 5.2.3 Spring...

CVE-2020-5398

A flaw was found in springframework in versions prior to 5.0.16, 5.1.13, and 5.2.3. A reflected file download RFD attack is possible when a "Content-Disposition" header is set in response to where the filename attribute is derived from user supplied input. The highest threat from this vulnerabili...

CVE-2019-20402

Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability...

MoMoCMS has an arbitrary file download vulnerability

MoMoCMS is an enterprise building system developed by php+MySQL. MoMoCMS has an arbitrary file download vulnerability. An attacker can exploit the vulnerability to obtain sensitive information...

Vulnerability fixed in Spring Framework

A vulnerability has been fixed in Spring Framework. The vulnerability allows a malicious party to perform a reflected file download RFD attack. The developers of Spring Framework have released updates to fix the vulnerability. More information can be found at the page below:...

CVE-2020-7999

The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOADAPIKEY and FILEDOWNLOADAPIKEY...

PT-2020-19910

Name of the Vulnerable Software and Affected Versions Intellian Aptus application version 1.0.2 Description The issue concerns hardcoded values for DOWNLOAD API KEY and FILE DOWNLOAD API KEY in the application. Recommendations For Intellian Aptus application version 1.0.2, consider restricting...

Exploit for Injection in Mediawiki

CVE-2017-8809 - RFDReflected File Download for MediaWiki...

Huawei GaussDB 200 Directory Traversal Vulnerability

Huawei GaussDB 200 is a distributed parallel relational database system developed by Huawei China based on the open source database Postgres-XC. A directory traversal vulnerability exists in Huawei GaussDB 200 version 6.5.1, which stems from a failure to validate input paths. An attacker could us...