Unauthenticated db-file-storage views

Impact In Nautobot 1.x and 2.0.x, the URLs /files/get/?name=... and /files/download/?name=... are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job...

Information Disclosure

nautobot is vulnerable to Information Disclosure. The vulnerability exists because the library uses django-db-file-storage by default, and it does not require any user authentication to access the database file storage. This allows an attacker to view files in the database storage and potentially...

PYSEC-2023-286

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs /files/get/?name=... and /files/download/?name=... are used to provid...

CVE-2023-50263 Nautobot allows unauthenticated db-file-storage views

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs /files/get/?name=... and /files/download/?name=... are used to provid...

The vulnerability of the SEMCMS_Upfile.php script of the website management system used by SemCms’ foreign trade enterprises allows a hacker to execute arbitrary code.

The vulnerability of the SEMCMSUpfile.php script in the website management system used by SemCms foreign trade enterprises involves unlimited downloading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2023-28875

A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link...

Schneider Electric Galaxy VS and Schneider Electric Galaxy VL Path Traversal Vulnerabilities

Schneider Electric Galaxy VS and Schneider Electric Galaxy VL are both products of Schneider Electric, France.Schneider Electric Galaxy VS is a power protection device for edge, small and medium-sized data centers, and other business-critical applications. Schneider Electric Galaxy VL is a power...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

Input validation

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

PT-2023-31651 · Lenovo · Lenovo Lecloud App

Name of the Vulnerable Software and Affected Versions: Lenovo LeCloud App affected versions not specified Description: The issue is related to improper input validation in the Lenovo LeCloud App, allowing attackers to access arbitrary components and perform arbitrary file downloads. This could...

The vulnerability of the /emap/devicePoint_addImgIco?hasSubsystem=true file is related to the unlimited loading of dangerous files. This vulnerability allows a violator to execute arbitrary code.

Vulnerability of the file /emap/devicePointaddImgIco?hasSubsystem=true. Dahua Smart Park Management’s smart technology for parking management involves unlimited downloading of dangerous type files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

GHSA-GV2C-5G79-H73C Ibexa ezplatform-kernel download route allows filename change

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

Ibexa ezplatform-kernel download route allows filename change

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

GHSA-946C-F9W6-2C25 Download route allows filename change in eZpublish kernel

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

Download route allows filename change in eZpublish kernel

Impact The route used for file downloads allows specifying the name of the downloaded file. This is an unintended side effect of the implementation, and means one could construct download URLs with filenames that have no relation to the actual file, which could lead to misunderstandings and...

The vulnerability of the LinuxASMCallGraph software development tool, related to the unlimited loading of dangerous files, allows a hacker to execute arbitrary code.

The vulnerability of the LinuxASMCallGraph graph-building software lies in the ability to download unlimited quantities of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by downloading a specially created ZIP file remotely...

PT-2023-33018 · Ibexa · Ibexa Dxp +1

Name of the Vulnerable Software and Affected Versions: Ibexa DXP and eZ Platform versions affected versions not specified Description: The issue allows specifying the name of the downloaded file in the route used for file downloads, which could lead to misunderstandings, confusion, and possibly...