WordPress CM Download Manager Plugin < 2.9.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software CM Download Manager Type Plugin Vulnerable versions 2.9.0 Fixed in 2.9.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1231 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5c1dfeb9504e Credits Sushmita Poudel...

WordPress CM Download Manager Plugin < 2.9.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software CM Download Manager Type Plugin Vulnerable versions 2.9.1 Fixed in 2.9.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1962 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 58e54ec534ca Credits Bob Matyas Require...

WordPress Plugin CM Download Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Plugin CM Download Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Plugin CM Download Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WebRAT 代码问题漏洞

WebRAT is a simple remote web management tool. A code issue vulnerability exists in cyberaz0r WebRAT, which stems from a security issue in the downloadfile function in Server/api.php, which causes unrestricted uploads via the parameter name...

PT-2024-10836 · Unknown · Cyberaz0R Webrat

Name of the Vulnerable Software and Affected Versions: cyberaz0r WebRAT up to 20191222 Description: A critical issue affects the function download file of the file Server/api.php. The manipulation of the argument name leads to unrestricted upload. The attack can be initiated remotely. The real...

PT-2024-18456 · Unknown · Cm Download Manager

Name of the Vulnerable Software and Affected Versions: CM Download Manager versions prior to 2.9.1 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to manipulate logged-in admins into editing downloads via a CSRF attack. Recommendations: For...

PT-2024-17541 · WordPress · Cm Download Manager

Name of the Vulnerable Software and Affected Versions: CM Download Manager WordPress plugin versions prior to 2.9.0 Description: The issue concerns a lack of CSRF checks in certain areas of the plugin, which could allow attackers to trick logged-in administrators into deleting downloads via a CSR...

Denial of service while parsing a tar file due to lack of folders count validation

Description: During some analysis today on npm's node-tar package I came across the folder creation process, Basicly if you provide node-tar with a path like this ./a/b/c/foo.txt it would create every folder and sub-folder here a, b and c until it reaches the last folder to create foo.txt, In-thi...

CVE-2024-27190

Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2...

CVE-2024-27190

Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2...

CVE-2024-27190 WordPress Download Media plugin <= 1.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2...

CVE-2024-27190

CVE-2024-27190 affects WordPress Plugin Download Media (Jean-David Daviet) with Missing Authorization in versions n/a through 1.4.2. Root cause: broken access control allowing unauthorized access. Exploitation status is not provided in the documents. Patch status for this entry is Unpatched; reme...

CVE-2024-27190 WordPress Download Media plugin <= 1.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2...

CVE-2024-1147

Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files...

CVE-2024-1147 Weak Access Control - Arbitrary file download

Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files...

CVE-2024-1147 Weak Access Control - Arbitrary file download

Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files...

CVE-2024-1147

CVE-2024-1147 describes a weakness in OpenText PVCS Version Manager with weak access control that can bypass authentication to download files. The PT-2024-17018 entry specifies affected versions: OpenText PVCS Version Manager prior to 8.6.3.3. The advisory recommends upgrading to version 8.6.3.3 ...

Gatekeeper Template Injection in Confluence Data Center

This High severity Gatekeeper Injection vulnerability was introduced in versions 7.1.0 of Confluence Data Center. This Injection vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to modify the actions taken by a system call which has high impact to confidentiality, high...