CVE-2018-16088

A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no user input via a crafted HTML page...

CVE-2018-16088

A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no user input via a crafted HTML page...

CVE-2018-16088

CVE-2018-16088 affects Google Chrome (Blink) due to a missing check for JS-simulated input events, allowing a remote attacker to download arbitrary files with no user input via a crafted HTML page. Chrome 69.0.3497.81 addresses the flaw; updating to that version or newer is the remediation descri...

WordPress NikolayDyankovDesign Themes Arbitrary File Download Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress NikolayDyankovDesign Themes suffers from an arbitrary file download vulnerability. An attacker can exploit the...

CVE-2018-5204

ML Report version Between 2.00.000.0000 and 2.18.628.5980 contains a vulnerability that could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. this can be leveraged for code execution...

Unspecified Vulnerability in FEBS-Shiro

FEBS-Shiro is a set of back-end permissions management system based on the Sping Boot framework . A security vulnerability exists in the 'fileDownload' function of the CommonController class in versions of FEBS-Shiro prior to 2018-11-05. An attacker can exploit the vulnerability by sending a...

Arbitrary File Download Vulnerability in eDoc Frontend of Electronic Document Library

Electronic document library eDoc is a click document management system developed by Anhui Qixing Studio. Electronic document library eDoc foreground exists arbitrary file download vulnerability, attackers can use the vulnerability to obtain sensitive documents...

CVE-2018-20437

An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An attacker can download a file via a request of the form /common/download?filename=1.jsp&delete=false. NOTE: the software maintainer disputes the significance of this report becaus...

CVE-2018-20437

An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An attacker can download a file via a request of the form /common/download?filename=1.jsp&delete=false. NOTE: the software maintainer disputes the significance of this report becaus...

CVE-2018-20437

An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An attacker can download a file via a request of the form /common/download?filename=1.jsp&delete=false. NOTE: the software maintainer disputes the significance of this report becaus...

CVE-2018-20437: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An attacker can download a file via a request of the form /common/download?filename=1.jsp&delete=false. NOTE: the software maintainer disputes the significance of this report becaus...

PT-2018-15376 · Febs · Febs-Shiro

Name of the Vulnerable Software and Affected Versions: FEBS-Shiro versions prior to 2018-11-05 Description: An issue was discovered in the fileDownload function in the CommonController class. An attacker can download a file via a request of the form /common/download?filename=1.jsp&delete=false...

CVE-2018-1000817

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

Race condition

In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results in remote code execution...

CVE-2018-5198 WIZVERA Veraport Race Condition Vulnerability

In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results in remote code execution...

CVE-2018-1000817: Improper Limitation of a Pathname to a Restricted Directory

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...

CVE-2018-5198: Concurrent Execution using Shared Resource with Improper Synchronization

In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results in remote code execution...

PT-2018-9541

Name of the Vulnerable Software and Affected Versions Asset Pipeline Grails Plugin versions prior to 2.14.1.1 Asset Pipeline Grails Plugin versions prior to 2.15.1 Asset Pipeline Grails Plugin versions prior to 3.0.6 Description The issue is related to Incorrect Access Control in Applications...

PT-2018-16792 · Veraport · Veraport G3

Name of the Vulnerable Software and Affected Versions: Veraport G3 ALL on MacOS affected versions not specified Description: A race condition exists when calling the Veraport API, allowing a remote attacker to cause arbitrary file download and execution, resulting in remote code execution...

WordPress Total-Child-Theme-Master Themes Arbitrary File Download Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An arbitrary file download vulnerability exists in WordPress Total-Child-Theme-Master Themes. An attacker can exploit the...