316 matches found
CVE-2020-35577
Endalia Selection Portal (before 4.205.0) is affected by an Insecure Direct Object Reference (IDOR) vulnerability. Authenticated users can download any uploaded file by altering the file identifier (CommonDownload ID). This is the root cause described across multiple sources linked to CVE-2020-35...
Cisco Multiple Routers Authorization Header Command Injection Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Cisco RV16x and RV26x routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of file downloads. When parsing the Authorization...
FeiFeiCms is vulnerable to arbitrary file downloads
FeiFeiCms is a free and open source PHP movie program , focusing on providing , video on demand , film and television aggregation services. FeiFeiCms arbitrary file download vulnerability , attackers can exploit the vulnerability to download arbitrary files...
Cisco Security Manager Path Traversal Vulnerability
Cisco Security Manager CSM is a suite of enterprise-level management applications from Cisco that are used to configure firewall, VPN, and intrusion protection security services on Cisco network and security devices. A path traversal vulnerability exists in Cisco Security Manager 4.21 and earlier...
Konzept-iX PubliXone Information Disclosure Vulnerability
Konzept-iX PubliXone is a media production and document editing software from the German company Konzept-iX. PubliXone 2019.045 suffers from an information disclosure vulnerability that can cause cross-site scripting, account takeover, lack of access control, hard-coded keys, and file download...
Konzept-iX PubliXone Encryption Problem Vulnerability
Konzept-iX PubliXone is a media production and document editing software from the German company Konzept-iX. Konzept-iX PubliXone version 2019.045 suffers from an encryption issue vulnerability that causes PubliXone to suffer from cross-site scripting, account takeover, lack of access control,...
Konzept-iX PubliXone Cross-Site Scripting Vulnerability
Konzept-iX PubliXone is a media production and document editing software from the German company Konzept-iX. A cross-site scripting vulnerability exists in Konzept-iX PubliXone version 2019.045, which exposes PubliXone to cross-site scripting, account takeover, lack of access control, hard-coded...
The vulnerability of the AcyMailing email marketing manager lies in the lack of restrictions on file downloads, allowing attackers to execute arbitrary code.
The vulnerability of the AcyMailing email marketing manager is related to the lack of restrictions on file uploads. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Unauthorized File Access in atompm
Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system. Recommendation Upgrade to version 0.8.2 or later...
GHSA-V86X-F47Q-F7F4 Unauthorized File Access in atompm
Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system. Recommendation Upgrade to version 0.8.2 or later...
Debian: Security Advisory (DLA-2352-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Mozilla Firefox Resource Management Error Vulnerability (CNVD-2020-46335)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in iOS-based Mozilla Firefox prior to version 28. The vulnerability can be exploited by an attacker with the help of a malicious page to cause users to download illegal...
CVE-2020-12404
For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS 26...
The vulnerability of the ColdFusion interpreter lies in the lack of restrictions on file uploads, which allows attackers to execute arbitrary code.
The vulnerability of the ColdFusion interpreter lies in the lack of restrictions on the download of files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the cwpsrv-xxx cookie file in the CentOS Web Panel application allows a hacker to elevate their privileges to the root level.
The vulnerability of the cwpsrv-xxx cookie file in the CentOS Web Panel application management server application is related to the unlimited download of dangerous files. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to the root level remotely...
Code injection
The updatebad,phishingsites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption e.g., https or digital signature checking which could allow an attacker to replace certain configuration files e.g., phishing whitelist via dns/packet spoofing...
CVE-2010-3292
The CVE-2010-3292 entry concerns MailScanner (update{_bad,}_phishing_sites scripts) versions around 4.79.11-2. The vulnerability arises because downloaded files are trusted without encryption (e.g., HTTPS) or digital signatures, enabling a man-in-the-middle or spoofing to replace critical configu...
CVE-2010-3292
The updatebad,phishingsites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption e.g., https or digital signature checking which could allow an attacker to replace certain configuration files e.g., phishing whitelist via dns/packet spoofing...
Transmission has unspecified vulnerabilities
Transmission is an open source BitTorrent client application. The program mainly provides features such as file downloads. A security vulnerability exists in Transmission versions prior to 1.92, which can be exploited by attackers to prevent file downloads...
