CVE-2024-41922

A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

CVE-2024-47617 Reflected XSS Vulnerability in Sulu Media Bundle

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting XSS issue, which could potentially...

CVE-2024-47617 Reflected XSS Vulnerability in Sulu Media Bundle

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting XSS issue, which could potentially...

CVE-2024-47617

Sulu CMS is affected by a Reflected XSS in the media download URL via the SuluMediaBundle. The issue stems from how the slug parameter is handled in the MediaStreamController downloadAction, allowing injection of arbitrary HTML/JavaScript. Affected versions include 2.6.4/2.5.20 (prior to fixes). ...

Malicious File Download

scoutbrowser is vulnerable to Malicious File Download. The vulnerability is due to insufficient input validation for filenames, which does not properly sanitize the file extensions before serving the files to users, allowing attackers to manipulate file extensions and deliver malicious content...

CVE-2024-8352

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the downloadlog function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

CVE-2024-8352 Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the downloadlog function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

CVE-2024-8352 Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the downloadlog function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

WordPress Social Web Suite plugin <= 4.1.11 - Directory Traversal to Arbitrary File Download vulnerability

Directory Traversal to Arbitrary File Download vulnerability discovered by Thanh Nam Tran in WordPress Plugin Social Web Suite versions = 4.1.11...

PT-2024-29635 · Veertu · Veertu Anka Build

Name of the Vulnerable Software and Affected Versions: Veertu Anka Build version 1.42.0 Description: A directory traversal vulnerability exists in the log files download functionality. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an...

PT-2024-40013 · Saltcorn · Saltcorn

Name of the Vulnerable Software and Affected Versions: Saltcorn versions 1.0.0 through 1.0.0-beta.13 Description: A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed...

WordPress Social Web Suite Plugin <= 4.1.11 is vulnerable to Arbitrary File Download

Software Social Web Suite Type Plugin Vulnerable versions = 4.1.11 Fixed in 4.1.12 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-8352 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 9b823a04681b Credits Thanh Nam Tran Required...

Veertu Anka Build registry archive files directory traversal vulnerability

Talos Vulnerability Report TALOS-2024-2059 Veertu Anka Build registry archive files directory traversal vulnerability October 3, 2024 CVE Number CVE-2024-41163 SUMMARY A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP...

CVE-2024-46977

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...

PYSEC-2024-101

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...

CVE-2024-46977 OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data

A new set of malicious packages has been unearthed in the Python Package Index PyPI repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust...

PT-2024-38966 · WordPress · Social Web Suite – Social Media Auto Post

Name of the Vulnerable Software and Affected Versions: The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress versions up to, and including, 4.1.11 Description: The issue concerns a Directory Traversal vulnerability, which allows unauthenticated attackers to...

OpenC3 COSMOS 路径遍历漏洞

OpenC3 COSMOS is an OpenC3 open source application. A path traversal vulnerability exists in OpenC3 COSMOS versions prior to 5.19.0. An attacker exploits this vulnerability to download any .txt file by running ScreensControllershow on the web server...

Incorrect delegation lookups can make go-tuf download the wrong artifact

During the ongoing work on the TUF conformance test suite, we have come across a test that reveals what we believe is a bug in go-tuf with security implications. The bug exists in go-tuf delegation tracing and could result in downloading the wrong artifact. We have come across this issue in the...