Unauthorized File Access in atompm

Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system. Recommendation Upgrade to version 0.8.2 or later...

GHSA-V86X-F47Q-F7F4 Unauthorized File Access in atompm

Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system. Recommendation Upgrade to version 0.8.2 or later...

Debian: Security Advisory (DLA-2352-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mozilla Firefox Resource Management Error Vulnerability (CNVD-2020-46335)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in iOS-based Mozilla Firefox prior to version 28. The vulnerability can be exploited by an attacker with the help of a malicious page to cause users to download illegal...

CVE-2020-12404

For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS 26...

The vulnerability of the ColdFusion interpreter lies in the lack of restrictions on file uploads, which allows attackers to execute arbitrary code.

The vulnerability of the ColdFusion interpreter lies in the lack of restrictions on the download of files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the cwpsrv-xxx cookie file in the CentOS Web Panel application allows a hacker to elevate their privileges to the root level.

The vulnerability of the cwpsrv-xxx cookie file in the CentOS Web Panel application management server application is related to the unlimited download of dangerous files. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to the root level remotely...

Code injection

The updatebad,phishingsites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption e.g., https or digital signature checking which could allow an attacker to replace certain configuration files e.g., phishing whitelist via dns/packet spoofing...

CVE-2010-3292

The updatebad,phishingsites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption e.g., https or digital signature checking which could allow an attacker to replace certain configuration files e.g., phishing whitelist via dns/packet spoofing...

CVE-2010-3292

The CVE-2010-3292 entry concerns MailScanner (update{_bad,}_phishing_sites scripts) versions around 4.79.11-2. The vulnerability arises because downloaded files are trusted without encryption (e.g., HTTPS) or digital signatures, enabling a man-in-the-middle or spoofing to replace critical configu...

Transmission has unspecified vulnerabilities

Transmission is an open source BitTorrent client application. The program mainly provides features such as file downloads. A security vulnerability exists in Transmission versions prior to 1.92, which can be exploited by attackers to prevent file downloads...

CVE-2014-10397

The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php...

CVE-2014-10396

The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php...

Design/Logic Flaw

The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php...

Design/Logic Flaw

The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php...

CVE-2014-10397

The CVE-2014-10397 entry concerns the Antioch WordPress theme (up to 2014-09-07). A vulnerability in lib/scripts/download.php allows an attacker to trigger arbitrary file downloads by manipulating the file parameter, enabling partial confidentiality impact. Root cause is improper handling of the ...

CVE-2014-10397

The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php...

CVE-2014-10396

The CVE-2014-10396 entry corresponds to a vulnerability in the Epic WordPress theme (prior to fix date not provided in the documents) that allows arbitrary file downloads through the file parameter to includes/download.php. Affected component: Epic WordPress theme; vulnerability type: arbitrary f...

CVE-2014-10396

The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php...

CVE-2019-9886

CVE-2019-9886 affects BroadLearning eClass up to version ip.2.5.10.2.1, where arbitrary files can be downloaded without authentication via URLs containing download_attachment.php under templates or home folders. Root cause/impact: unauthenticated access to sensitive files (no login required). Pub...