CVE-2022-2222

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

CVE-2022-2222

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

Design/Logic Flaw

The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup...

CVE-2022-2222

CVE-2022-2222 affects the WordPress Download Monitor plugin. Versions prior to 4.5.91 fail to constrain downloaded files to the blog directory, enabling high-privilege users (e.g., admins) to download sensitive files such as wp-config.php or /etc/passwd. The issue is described across multiple sou...

PT-2022-15295

Name of the Vulnerable Software and Affected Versions Download Monitor WordPress plugin versions prior to 4.5.91 Description The issue allows high privilege users, such as administrators, to download sensitive files like wp-config.php or /etc/passwd, even in hardened environments or multisite...

Cisco Unified Communications Manager Arbitrary File Read (cisco-sa-ucm-file-read-qgjhEc3A)

The version of Cisco Unified Communications Manager Unified CM is affected by a vulnerability in its web-based management interface that allows an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. This vulnerability is due to improper...

Directory traversal

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of a...

CVE-2022-20862 Cisco Unified Communications Manager Arbitrary File Read Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of a...

CVE-2022-20862 Cisco Unified Communications Manager Arbitrary File Read Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of a...

U.S. Dept Of Defense: IDOR leading unauthenticated attacker to download documents discloses PII of users and soldiers via https://www.█████████/Download.aspx?id= [HtUS]

The API endpoint at https://www.█████████/Download.aspx?id= was found to be vulnerable to Insecure Direct Object Reference IDOR, allowing an unauthenticated attacker to download sensitive documents containing PII of users and soldiers...

Parallels Desktop Updater Incorrect Permission Assignment Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the update...

SP Project & Document Manager < 4.58 - Sensitive File Disclosure

The plugin uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files. PoC 1. Upload a file using the plugin. 2. On another browser, access the newly uploaded file via:...

CVE-2022-31036

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user...

CVE-2022-31036 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user...

Secheron SEPCOS Control and Protection Relay Access Control Error Vulnerability

The Secheron SEPCOS Control and Protection Relay is a relay from Secheron. Control and protect your DC panels and contact lines from short circuits and other electrical faults, and benefit from enhanced communication capabilities.The Secheron SEPCOS Control and Protection Relay is vulnerable to a...

CVE-2022-2103

An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories...

Design/Logic Flaw

An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories...

CVE-2022-2103 Secheron SEPCOS Control and Protection Relay

An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories...

CVE-2022-2103

The CVE-2022-2103 vulnerability affects Secheron SEPCOS Control and Protection Relay. Affected firmware: SEPCOS Single Package before 1.23.22, before 1.24.8, and before 1.25.3. Attack vector involves an attacker with weak credentials accessing the TCP port via FTP to read sensitive files and writ...

CVE-2022-2103 Secheron SEPCOS Control and Protection Relay

An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories...