316 matches found
Design/Logic Flaw
The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local acces...
VulnCheck KEV: CVE-2017-11512
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...
The vulnerability of the Xstream Java library for converting objects into XML or JSON formats allows attackers to download files of dangerous types indefinitely. This enables attackers to upload and execute arbitrary code from a remote host.
The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability could allow an attacker to download and execute arbitrary code from a remote host by...
CVE-2021-41281
Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. T...
The vulnerability of the Xstream Java library for converting objects into XML or JSON formats allows attackers to download files of dangerous types indefinitely. This enables attackers to upload and execute arbitrary code from a remote host.
The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability could allow an attacker to download and execute arbitrary code from a remote host by...
The vulnerability in the web interface of the Pulse Connect Secure VPN server for corporate networks allows a perpetrator to execute arbitrary code.
The vulnerability in the web interface of VPN servers for corporate networks provided by Pulse Connect Secure relates to the unlimited download of files with the .gzip extension. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
Siemens Mendix 安全漏洞
A security vulnerability exists in Siemens Mendix, a low-code application development platform from Siemens, Germany. The vulnerability stems from the fact that applications built with the affected version of Mendix Studio Pro do not prevent the caching of file documents when opening or downloadi...
Backdoor.Win32.Hupigon.acio Unauthenticated Open Proxy
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/21f324a6a62d8125bc83b8d1865e17f9B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.acio Vulnerability: Unauthenticated Open Proxy Description: The malware...
Cisco Identity Services Engine 安全漏洞
Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from networks, users, and devices to develop and enforce policies to regulate the network. A security vulnerability exists in...
The vulnerability of the CiviCRM web-based contact tracking and interaction management system lies in the lack of restrictions on file downloads. This allows attackers to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the CiviCRM contact tracking and interaction management web system is related to the ability to upload and execute PHAR archives. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service failure...
The vulnerability of the Pulse Connect Secure corporate network VPN server, related to the unlimited download of dangerous types of files, allows a hacker to execute arbitrary code.
The vulnerability of the Pulse Connect Secure corporate network VPN server is related to the unlimited download of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by downloading a specially created archive through the web administrator interface...
The vulnerability of the prodViewUpdate.php implementation of the online e-commerce sales system allows a hacker to execute arbitrary code.
The vulnerability of the prodViewUpdate.php implementation in the online e-commerce website system is related to the unlimited downloading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
The vulnerability of the File Manager plugin (wp-file-manager) of the WordPress content management system allows a hacker to execute arbitrary PHP code on the target system.
The vulnerability of the File Manager plugin wp-file-manager in the WordPress content management system is related to the ability to download files of a dangerous type without limitation. Exploiting this vulnerability allows a malicious actor to execute any PHP code on the target system remotely...
Backdoor.Win32.Hupigon.gsy Unauthenticated Open Proxy
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/7e99aa748b61fd0802fa19cf9e4cf1f8.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.gsy Vulnerability: Unauthenticated Open Proxy Description: The malware listen...
The vulnerability of the Admidio membership management and access control application lies in its ability to download files of a dangerous type without limitation, allowing a perpetrator to execute arbitrary code.
The vulnerability of the Admidio membership management and access control application lies in the ability to download unlimited files of a dangerous type. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code using specially created .phar files...
How to remove the File Transfer Tab in a Full VPN NetScaler Gateway
How to remove the "File Transfer" Tab to prevent users from downloading files when accessing the environment through the NetScaler Gateway...
The vulnerability of the module for creating and editing user-form templates of the “LOCMAN Designer Form” in the LOCMAN Product Lifecycle Management system lies in its ability to download files of a dangerous type indefinitely, allowing a perpetrator to execute arbitrary code.
The vulnerability of the module responsible for creating and editing user-form templates in the “LOZMAN Designer Form” component of the LOZMAN Product Lifecycle Management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow an attacker to execu...
InvoicePlane Path Traversal Vulnerability
InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a path traversal vulnerability that originates from a misconfigured web server that allows unauthenticated...
Arbitrary File Download Vulnerability in Dahua In-vehicle Comprehensive Management Platform of Zhejiang Dahua Technology Company Limited (CNVD-2021-35888)
Zhejiang Dahua Technology Co., Ltd. is a video-centered intelligent IOT solution provider and operation service provider. An arbitrary file download vulnerability exists in the Dahua vehicle integrated management platform of Zhejiang Dahua Technology Co. An attacker can exploit the vulnerability ...
The vulnerability of the online configuration software EcoStruxure Power Build lies in its ability to download unlimited amounts of dangerous files, allowing a hacker to execute arbitrary code.
The vulnerability of the online configuration software of EcoStruxure Power Build lies in the ability to download unlimited files of a malicious nature. Exploiting this vulnerability could allow an attacker to execute arbitrary code...