CVE-2019-17561

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability...

SUSE CVE-2016-5196

The content renderer client in Google Chrome prior to 54.0.2840.85 for Android insufficiently enforced the Same Origin Policy amongst downloaded files, which allowed a remote attacker to access any downloaded file and interact with sites, including those the user was logged into, via a crafted HT...

CVE-2024-12184

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the accuaformsdownloadsubmittedfile function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to download...

CVE-2025-24140

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. Files downloaded from the internet may not have the quarantine flag applied...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS version 15.3, which originates from a file downloaded from the Internet where the quarantine flag may not be applied...

The vulnerability in the full-screen notification mode of the Mozilla Firefox browser on Android operating systems allows a hacker to perform spoofing attacks.

The vulnerability in the full-screen notification mode of the Mozilla Firefox browser on Android operating systems relates to the absence of warnings about dangerous actions when loading pop-up windows for downloaded files. Exploiting this vulnerability allows a remote attacker to carry out...

MAL-2024-2249 Malicious code in down_load_epub_the_mystery_at_dunvegan_castle_5o3xgv (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2164 Malicious code in down_load_ebook_contabilidad_financiera_bajo_niif_generalidades_y_by_gloria_cecilia_davila_giraldo_dilia_castillo_noss_9g9w6 (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2142 Malicious code in down_load_ebook_beautiful_enemy_by_piper_lawson_juv1k (npm)

--- -= Per source details. Do not edit below this line.=-...

(Pwn2Own) Ubiquiti Networks EV Station EVCLauncher Improper Certificate Validation Vulnerability

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of Ubiquiti Networks EV Station. User interaction is not required to exploit this vulnerability. The specific flaw exists within the EVCLauncher application. The...

PT-2024-26004 · Unknown · Kioware For Windows

Name of the Vulnerable Software and Affected Versions: KioWare for Windows versions all through 8.35 Description: The issue allows an attacker to escape the environment by downloading PDF files, which are then opened in an external PDF viewer. This can lead to launching a web browser, searching...

Scalefusion kiosk security vulnerability

ScaleFusion is a mobile device management and unified endpoint management application from ScaleFusion. A security vulnerability exists in the Scalefusion kiosk version 10.5.2, which stems from a file download that may occur, resulting in the inability to properly restrict users from using the Ed...

CVE-2013-2513

The flashtool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file...

Command injection

The flashtool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file...

CVE-2013-2513

The flashtool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file...

PT-2023-33002 · Ez Systems +1 · Ezpublish-Kernel +2

Name of the Vulnerable Software and Affected Versions: Ibexa DXP and eZ Platform affected versions not specified ezsystems/ezpublish-kernel affected versions not specified Description: The issue allows specifying the name of the downloaded file in the route used for file downloads, which could le...

CVE-2023-5523

Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution...

Vulnerabilities in Best Practical RT fixed

Vulnerabilities have been fixed in Best Practical Request Tracker RT. The vulnerabilities allow an unauthenticated malicious person able to impersonate an RT user and to download specific email attachments to download. Best Practical has released updates to fix the vulnerabilities fixes in RT. Fo...

M-Files Web Cross-Site Scripting Vulnerability

M-Files Web is an intelligent information management platform from M-Files USA, Inc. It is used to optimally support users in their daily work. A cross-site scripting vulnerability exists in M-Files Web versions prior to 23.10, which stems from a flaw in the execution of downloaded content that...

Design/Logic Flaw

In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replacing a resource script file created by an instruction at run time with a malicious script. The 1E Client's temporary directory is now locke...