CVE-2024-9829 Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download

The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwaphandledownloaduser' and 'dpwaphandledownloadcomment' functions in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, wit...

The vulnerability of Adobe InDesign’s automation tool for computer design lies in its ability to download files of a malicious nature without limitation, allowing attackers to execute arbitrary code.

The vulnerability of Adobe InDesign’s computer layout automation tool is related to the ability to download files of a malicious nature without limitation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Nomad application orchestrators, related to incorrect resolution of link references before the file name, allows attackers to execute arbitrary code.

The vulnerability of Nomad application orchestrators is related to incorrect resolution of the link before the file is downloaded. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of Adobe InCopy, a text creation and editing software, relates to the ability to download files of a malicious nature indefinitely. This allows a hacker to execute arbitrary code.

The vulnerability of the Adobe InCopy text creation and editing software is related to the ability to download files of a malicious nature without limitation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2024-39871 · Unknown · Download Plugin

Name of the Vulnerable Software and Affected Versions: Download Plugin versions up to, and including, 2.2.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to download any comment and metadata for any user, including sensitive information such as...

WordPress Download Plugin plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download vulnerability

Missing Authorization to Authenticated Subscriber+ User Metadata and Comment Download vulnerability discovered by WordFence in WordPress Plugin Download versions = 2.2.0...

WordPress Download Plugin Plugin <= 2.2.0 is vulnerable to Broken Access Control

Software Download Plugin Type Plugin Vulnerable versions = 2.2.0 Fixed in 2.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9829 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID da1ab1cf4af2 Credits WordFence Required...

ABB Cylon Aspect 3.08.01 mapConfigurationDownload.php Configuration Download Vulnerability

ABB Cylon Aspect version 3.08.01 suffers from an unauthenticated configuration download vulnerability. This can be exploited to download the SQLite DB that contains the configuration mappings information via the FTControlServlet by directly calling the mapConfigurationDownload.php script. ABB Cyl...

Dolibarr 16.x < 16.0.5 Database Download

Dolibarr versions 16.x 16.0.5 suffer from an improper access control vulnerability, allowing a remote and unauthenticated attacker to access the target instance contact database, including public and private notes. No source data...

Wellchoose Administrative Management System 安全漏洞

Wellchoose Administrative Management System is an administrative management system from China Weiweiqiao Information Wellchoose Company. A security vulnerability exists in the Wellchoose Administrative Management System. A remote attacker could exploit this vulnerability to download arbitrary fil...

Rockwell Automation ControlLogix Improper Input Validation (CVE-2024-6207)

A denial-of-service vulnerability exists in the affected products that will cause the device to result in a major nonrecoverable fault MNRF when it receives an invalid CIP request. To exploit this vulnerability a malicious user must chain this exploits with CVE-2021-22681 and send a specially...

PT-2024-16114 · Wellchoose · Administrative Management System

Name of the Vulnerable Software and Affected Versions: Administrative Management System from Wellchoose affected versions not specified Description: The Administrative Management System from Wellchoose has a Path Traversal issue, allowing unauthenticated remote attackers to exploit this...

CVE-2024-49315 WordPress FREE DOWNLOAD MANAGER plugin <= 1.0.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through = 1.0.0...

CVE-2024-49315 WordPress FREE DOWNLOAD MANAGER plugin <= 1.0.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through = 1.0.0...

MAL-2024-9341 Malicious code in avail-able-albu-m-down-load-15496-morning-view-pbn51-tjmcxv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a44acac841eaeacfa072df02665786202f3c5233f826cfc1e37e80b0c157395 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zip-mp3-a-lbum-do-wnload-new-coexist-l4rjg-vsisft (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbda29687ce05eceb8a7140f99fe1073db44c499a2817a3334aba733cda1eb29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in avail-able-albu-m-down-load-114925-rainier-fog-nuh7o-acneyh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab72642b19573c9e24f11f0ecbf3726e03c29dc2bd1ca90990c5d3d39e721730 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zip-mp3-a-lbum-do-wnload-new-in-the-future-vrf78-daqfza (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91e46e5ef66303112352a974ee7bc6779610608153a5c47dc2c5693586b6c6b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in down-load-available-zip-now-365509-chew-the-scenery-ymqd7-xaqqmu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39470e2ad654687e0841bb2740b376632c07ad817ddd755c4037149fb3872220 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9339 Malicious code in avail-able-albu-m-down-load-114925-rainier-fog-nuh7o-acneyh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab72642b19573c9e24f11f0ecbf3726e03c29dc2bd1ca90990c5d3d39e721730 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...