CVE-2016-4874

Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack...

Design/Logic Flaw

Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack...

CVE-2016-4874

Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack...

CVE-2016-4874

Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack...

CVE-2016-4874

CVE-2016-4874 affects Cybozu Office (versions 9.0.0 through 10.4.0). The vulnerability is a Reflected File Download (RFD) that could enable remote attackers to cause unintended files to be downloaded when a logged-in user visits a malicious page. Root cause details are not explicitly provided in ...

CVE-2016-9470

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. www/delivery/asyncspc.php was vulnerable to the fairly new Reflected File Download RFD web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a...

CVE-2016-9470

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. www/delivery/asyncspc.php was vulnerable to the fairly new Reflected File Download RFD web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a...

Design/Logic Flaw

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. www/delivery/asyncspc.php was vulnerable to the fairly new Reflected File Download RFD web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a...

CVE-2016-9470

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. www/delivery/asyncspc.php was vulnerable to the fairly new Reflected File Download RFD web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a...

CVE-2016-9470

Revive Adserver is affected by a Reflected File Download (RFD) vulnerability in the file www/delivery/asyncspc.php, impacting versions before 3.2.5 and 4.0.0. The issue allows an attacker to cause a victim’s machine to download a file from a trusted domain, potentially gaining control of the vict...

CVE-2016-6848

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client "Reflected File Download". Malicious platform specific e.g. Microsoft Windows batch file can be created via a trusted domain without...

CVE-2016-6848

CVE-2016-6848 affects Open-Xchange OX App Suite prior to 7.8.2-rev8. The issue allows via API requests to inject, generate and download executable files to the client using a Reflected File Download vector. A malicious platform-specific batch file can be created through a trusted domain without a...

CVE-2016-6848

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client "Reflected File Download". Malicious platform specific e.g. Microsoft Windows batch file can be created via a trusted domain without...

Revive Adserver Multiple Vulnerabilities

Revive Adserver is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:revive:adserver"; if...

Cybozu Office vulnerable to Reflected File Download (RFD)

Overview Cybozu Office contains a Reflected File Download RFD vulnerability. Jun Kokatsu of KDDI Singapore Dubai Branch reported this vulnerability to Cybozu, Inc., and Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc...

FreeBSD : phpmyadmin -- multiple vulnerabilities (ef70b201-645d-11e6-9cdc-6805ca0b3d42)

The phpmyadmin development team reports : Weakness with cookie encryption Multiple XSS vulnerabilities Multiple XSS vulnerabilities PHP code injection Full path disclosure SQL injection attack Local file exposure Local file exposure through symlinks with UploadDir Path traversal with SaveDir and...

Instacart: Reflected File Download on recipe list search

Hi guys, Right now I'm searching for JSON issues on your API so I started to go deep into the XHR requests. When I noticed the following request:...

Reflected File Download attack

PMASA-2016-51 Announcement-ID: PMASA-2016-51 Date: 2016-07-24 Summary Reflected File Download attack Description A vulnerability was discovered where an attacker may be able to trigger a user to download a specially crafted malicious SVG file. Severity We consider this issue to be of moderate...

CVE-2016-3168

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."...

CVE-2016-3168

The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."...