Arbitrary File Download Vulnerability in Aifei Routing System

LoveFast Routing System is a DPI-based network management system. There is an arbitrary file download vulnerability in AIFRS, which can be exploited by attackers to download arbitrary files and obtain sensitive information...

PT-2019-16035

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allowed unauthenticated file download, resulting in user information disclosure. Recommendations For versions prior to 4.2.3, update to version 4.2.3 or later to...

CVE-2019-19985: Missing Authorization

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

Coupon Pusher CMS suffers from arbitrary file download vulnerability

Push Couponer CMS is a completely free Taobao coupon website source code program, can automatically collect goods with coupons, automatically apply for high commission plan. Push Couponer CMS has an arbitrary file download vulnerability that can be exploited by attackers to cause directory and fi...

CVE-2019-17087

Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under...

CVE-2019-17087

Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under...

Arbitrary file deletion

Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under...

CVE-2019-17087

The CVE-2019-17087 entry describes an Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb, allowing enumeration/download of filesystem files with AcuToWeb’s running account privileges. The connected documents do not provide concrete technical details (root c...

CVE-2019-17087

Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under...

PT-2019-14942

Name of the Vulnerable Software and Affected Versions Micro Focus AcuToWeb versions affected versions not specified Description The issue allows for unauthorized file download, potentially enabling enumeration and download of files from the system's filesystem with the privileges of the account...

CVE-2019-17087: Undefined Security Weakness

Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under...

CVE-2019-19616

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

CVE-2019-19616

CVE-2019-19616 concerns an insecure direct object reference in the Xtivia Web Time and Expense (WebTE) interface for Microsoft Dynamics NAV prior to 2017. The vulnerability occurs in the /Home/GetAttachment function, where an attacker can download arbitrary files by supplying arbitrary values for...

CVE-2019-19616: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

Design/Logic Flaw

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed...

PT-2019-12192

Name of the Vulnerable Software and Affected Versions BMC Smart Reporting version 7.3 20180418 Description The issue allows authenticated XXE XML External Entity attacks within the import functionality. This can be exploited by importing a malicious XML file, enabling the attacker to download loc...

BMC Smart Reporting XML External Entity Injection Vulnerability

BMC Smart Reporting is a smart reporting system. BMC Smart Reporting suffers from an XML External Entity Injection vulnerability that allows an authenticated attacker with administrator privileges to import a malicious XML file and perform an XXE attack to download a local file from a server, or...

CVE-2019-11216: Unrestricted Upload of File with Dangerous Type

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XML file and perform XXE attacks to download local files from the server, or do DoS attacks with XML expansion attacks. XXE with direct response and XXE OOB are allowed...

Remote File Download Vulnerability in zzcms

zzcms is an asp language development of free station-building system, with simple and easy to use labels, secure system core, good user experience as a feature, is the best choice for station owners to build a station. zzzcms has a remote file download vulnerability, which can be exploited by...