CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

Security Bulletin: CVE-2024-3933 affects IBM® SDK, Java™ Technology Edition

Summary CVE-2024-3933 affects IBM SDK, Java Technology Edition. An update has been released to address the vulnerability. Vulnerability Details CVEID:CVE-2024-3933 DESCRIPTION: Eclipse Openj9 could allow a local authenticated attacker to bypass security restrictions, caused by the failure to...

CVE-2024-3269

CVE-2024-3269 affects the WordPress plugin Download Monitor (WPChill). The vulnerability arises from a missing capability check in the dlm_uninstall_plugin function, allowing an authenticated user to uninstall the plugin and delete its data. Affected versions are all up to and including 4.9.13; t...

ZKTeco ZKBioSecurity 安全漏洞

ZKTeco ZKBioSecurity is a web-based all-in-one platform from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco ZKBioSecurity version 6.1.1, which originates from a directory traversal vulnerability in photoBase64 that allows unauthenticated users to download local files from t...

PT-2024-24776 · WordPress · Download Monitor

Name of the Vulnerable Software and Affected Versions: Download Monitor plugin for WordPress versions up to, and including, 4.9.13 Description: The issue allows unauthorized access to functionality due to a missing capability check on the dlm uninstall plugin function. This makes it possible for...

WordPress plugin Download Monitor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Download Monitor plugin <= 4.9.13 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Download Monitor versions = 4.9.13...

CVE-2024-28826

Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...

CVE-2024-28826 Unrestricted upload and download paths in check_sftp

Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...

CVE-2024-28826 Unrestricted upload and download paths in check_sftp

Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...

CVE-2024-28826

Summary: CVE-2024-28826 affects Checkmk installations prior to 2.3.0p4, 2.2.0p27, 2.1.0p44, and 2.0.0 (EOL). Root cause: Improper restriction of local upload/download paths in the check_sftp function. Impact: Attackers with sufficient permissions can configure the check to read and write local fi...

CVE-2024-35343

Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L,...

CVE-2024-35343

Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L,...

Campbell Scientific CSI Web Server

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION : Exploitable remotely/low attack complexity Vendor : Campbell Scientific Equipment : CSI Web Server Vulnerabilities : Path Traversal, Weak Encoding for Password 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...

多款Anpviz产品 安全漏洞

Anpviz IPC is a series of network cameras from Anpviz. A security vulnerability exists in multiple Anpviz products that originates from a vulnerability that allows an unauthenticated attacker to download the device's running configuration to the /ConfigFile.ini or /config.xml URIs via an HTTP GET...

.NET 6.0 Update - May 28, 2024 (KB5039843)

None None...

.NET 7.0 Update - May 28, 2024 (KB5039844)

None None...

PT-2024-26442 · Anpviz · Anpviz

Name of the Vulnerable Software and Affected Versions: Anpviz products versions 3.2.2.2 and lower Description: The issue allows unauthenticated users to download the running configuration of the device via a HTTP GET request to "/ConfigFile.ini" or "/config.xml" URIs. This configuration file...

.NET 8.0 Update - May 28 2024 (KB5039845)

None None...

多款Anpviz产品 安全漏洞

Anpviz IPC is a series of network cameras from Anpviz. A security vulnerability exists in multiple Anpviz products that originates from a vulnerability that allows an unauthenticated attacker to download arbitrary files from the device's filesystem to /reloading/URI via an HTTP GET request.Affect...