CVE-2018-10691

An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log the system log. However, the same functionality allows an attacker to download the file without any authentication or authorization...

CVE-2018-13379

An Improper Limitation of a Pathname to a Restricted Directory "Path Traversal" in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download syste...

WordPress Simple File List plugin <= 3.2.4 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability found by Admavidhya N in WordPress Simple File List plugin versions = 3.2.4. Solution Update the WordPress Simple File List plugin to the latest available version at least 3.2.5...

Oracle Application Testing Suite DownloadServlet Directory Traversal (CVE-2019-2557)

A directory traversal vulnerability exists in Oracle Application Testing Suite. A remote authenticated attacker can exploit this vulnerability by sending a malicious request to the vulnerable server. Successful exploitation results in arbitrary file download from the target server...

Xiamen Weipin Network Technology Co., Ltd. website building system suffers from arbitrary file download vulnerability

Xiamen Weipin Network Technology Co., Ltd. is a company specializing in website construction, website planning, web design, mobile site construction, website revision, website maintenance, website hosting, Internet marketing, domain name hosting and other integrated Internet services. Xiamen Weip...

Simple File List Plugin <= 3.2.4 - Unauthenticated Arbitrary File Download

This vulnerability allows any user to download sensitive information by traversing the path Authentication required: NO...

CVE-2019-5942: Undefined Security Weakness

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to obtain files without access privileges via the Multiple Files Download function of application 'Cabinet'...

CVE-2019-1820 Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to...

CVE-2019-1717

A vulnerability in the web-based management interface of Cisco Video Surveillance Manager could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper validation of parameters handled by the web-based management interface. An attacker could...

Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to...

CVE-2019-1717: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the web-based management interface of Cisco Video Surveillance Manager could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper validation of parameters handled by the web-based management interface. An attacker could...

PT-2019-2197

Name of the Vulnerable Software and Affected Versions Cisco Video Surveillance Manager affected versions not specified Description The issue is related to improper validation of parameters handled by the web-based management interface, allowing an unauthenticated, remote attacker to access...

CVE-2017-12761

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

CVE-2017-12761

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

Sql injection

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

CVE-2017-12761

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

CVE-2017-12761

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

CVE-2017-12761

CVE-2017-12761 affects WebFile Explorer 1.0. The vulnerability arises from using the GET parameter in download.php (component: $file = $_GET['id']), enabling SQL Injection that leads to Arbitrary File Download (remote) via the attack vector download.php?id=WebExplorer/../config.php. Affected soft...

CVE-2017-12761: Improper Neutralization of Special Elements used in an SQL Command

http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download remote. The component is: $file = $GET'id' in download.php. The attack vector is:...

PT-2019-7913

Name of the Vulnerable Software and Affected Versions WebFile Explorer version 1.0 Description The issue allows for Arbitrary File Download remotely. It is related to a SQL Injection vulnerability. The component download.php is affected, specifically the variable $file = $ GET'id'. The attack...