GHSA-M3PX-VJXR-FX4M Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

Impact The export download route /filament-excel/path allowed downloading any file without login when the webserver allows ../ in the URL. Patches Patched with Version v2.3.3 Credits Thanks to Kevin Pohl for reporting this...

Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

Impact The export download route /filament-excel/path allowed downloading any file without login when the webserver allows ../ in the URL. Patches Patched with Version v2.3.3 Credits Thanks to Kevin Pohl for reporting this...

CVE-2024-42485

CVE-2024-42485 affects Filament Excel. The vulnerability exists in the export download route /filament-excel/{path}, where an attacker could leverage directory traversal using ../ to download arbitrary files without authentication when the webserver allows such paths. This could disclose sensitiv...

CVE-2024-42485 Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

Filament Excel enables excel export for Filament admin resources. The export download route /filament-excel/path allowed downloading any file without login when the webserver allows ../ in the URL. Patched with Version v2.3.3...

CVE-2024-42485 Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint

Filament Excel enables excel export for Filament admin resources. The export download route /filament-excel/path allowed downloading any file without login when the webserver allows ../ in the URL. Patched with Version v2.3.3...

WordPress Order Export for WooCommerce plugin <= 3.23 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Order Export for WooCommerce versions = 3.23...

CVE-2024-5487 SQL Injection

Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's export option...

CVE-2024-5487

CVE-2024-5487 affects Zohocorp ManageEngine ADAudit Plus versions below 8110. It is an authenticated SQL Injection vulnerability in the attack surface analyzer’s export option, with CVSS: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD) and base score 8.8 HIGH. Red Hat and other feeds corroborate the is...

PT-2024-29982 · Unknown · Filament Excel

Name of the Vulnerable Software and Affected Versions: Filament Excel versions prior to v2.3.3 Description: The export download route "/filament-excel/path" allowed downloading any file without login when the webserver allows ../ in the URL. This issue was reported by Kevin Pohl. Recommendations:...

WordPress Order Export for WooCommerce Plugin <= 3.23 is vulnerable to Sensitive Data Exposure

Software Order Export for WooCommerce Type Plugin Vulnerable versions = 3.23 Fixed in 3.24 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-43259 Patch priority Low CVSS severity Low 5.3 Developer WebFactory Ltd. PSID 49e9304e587a Credi...

ZOHO ManageEngine ADAudit Plus 安全漏洞

ZOHO ManageEngine ADAudit Plus is used by ZOHO USA, Inc. to simplify auditing, prove compliance and detect threats. A security vulnerability exists in ZOHO ManageEngine ADAudit Plus version 8110 and prior versions, which stems from a vulnerability to authenticated SQL injection attacks in the...

WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Products, Order & Customers Export for WooCommerce versions = 2.0.11...

WordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerability

Sensitive Information via Imported File vulnerability discovered by emad Patchstack Alliance in WordPress Plugin Import and export users and customers versions = 1.26.8...

WordPress Import and export users and customers Plugin <= 1.26.8 is vulnerable to Sensitive Data Exposure

Software Import and export users and customers Type Plugin Vulnerable versions = 1.26.8 Fixed in 1.26.9 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-38787 Patch priority Low CVSS severity Low 7.5 Developer Codection PSID a113b5766398 Credits emad...

CVE-2024-6477

The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address...

PT-2024-37654 · WordPress · Userswp

Name of the Vulnerable Software and Affected Versions: UsersWP WordPress plugin versions prior to 1.2.12 Description: The issue allows unauthenticated attackers to download sensitive information, including IP addresses, usernames, and email addresses, due to the use of predictable filenames when ...

WordPress plugin UsersWP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-41518

An Incorrect Access Control vulnerability in "/admin/programm//export/statistics" in Feripro = v2.2.3 allows remote attackers to export an XLSX file with information about registrations and participants...

CVE-2024-38878

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 All versions, Omnivise T3000 R8.2 SP3 All versions, Omnivise T3000 R8.2 SP4 All versions. Affected devices allow authenticated users to export diagnostics data. The corresponding API endpoint is susceptible to path...

CVE-2024-38878

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 All versions, Omnivise T3000 R8.2 SP3 All versions, Omnivise T3000 R8.2 SP4 All versions. Affected devices allow authenticated users to export diagnostics data. The corresponding API endpoint is susceptible to path...