WordPress plugin Download Monitor Arbitrary File Download Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file download...

WordPress Website File Changes Monitor plugin <= 1.8.2 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Nicolas VIDAL TEHTRIS in WordPress Website File Changes Monitor plugin versions = 1.8.2. Solution Update the WordPress Website File Changes Monitor plugin to the latest available version at least 1.8.3...

Website File Changes Monitor < 1.8.3 - Admin+ SQLi

The plugin does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manageoptions capability by default admins, leading to an SQL injection A user with manageoptions permission can exploit the vulnerability with the following request :...

CVE-2022-2222

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

CVE-2022-2222

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

CVE-2022-2222

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

Design/Logic Flaw

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

CVE-2022-2222

CVE-2022-2222 affects the WordPress Download Monitor plugin. Versions prior to 4.5.91 fail to constrain downloaded files to the blog directory, enabling high-privilege users (e.g., admins) to download sensitive files such as wp-config.php or /etc/passwd. The issue is described across multiple sou...

CVE-2022-2222 Download Monitor < 4.5.91 - Admin+ Arbitrary File Download

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

WordPress plugin Download Monitor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file download...

PT-2022-15295

Name of the Vulnerable Software and Affected Versions Download Monitor WordPress plugin versions prior to 4.5.91 Description The issue allows high privilege users, such as administrators, to download sensitive files like wp-config.php or /etc/passwd, even in hardened environments or multisite...

WordPress Download Monitor plugin <= 4.5.9 - Authenticated Arbitrary File Download vulnerability

Authenticated Arbitrary File Download vulnerability discovered by Thiago Martins, Jorge Buzeti, Leandro Inacio, Lucas de Souza, Matheus Oliveira, Filipe Baptistella, Leonardo Paiva, Jose Thomaz, Joao Maciel, Vinicius Pereira, Geovanni Campos, Hudson Nowak, Guilherme Acerbi in WordPress Download...

Malicious code in bfx-facs-monitor-tx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f6ae964cb0d1bdfa408ab9a93d26dae4619ba81e1286f943e4c2f6972eb73454 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1531 Malicious code in bfx-facs-monitor-tx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f6ae964cb0d1bdfa408ab9a93d26dae4619ba81e1286f943e4c2f6972eb73454 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8f7862810808843fa7ccd1ffa5156d35c5658c815a336338830de1376acc197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5289 Malicious code in perf-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8f7862810808843fa7ccd1ffa5156d35c5658c815a336338830de1376acc197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4428f5bd869858addd49edce49f8d71f8fc48bd69ab3605e79148a945adddb8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @azure-tests/perf-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d981d0c3bc3f93b7f2392e2029a93af9784e57dcdc6043ac18ff97dac615b16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-107 Malicious code in @azure-tests/perf-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d981d0c3bc3f93b7f2392e2029a93af9784e57dcdc6043ac18ff97dac615b16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-monitor-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6409892ee45f80a5b5f76cf05c31159bfe504375ae8e0f7ddf5a8b56bf3d566c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...