CVE-2026-6983

A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-6983 pagekit download server-side request forgery

A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit i...

PT-2026-35154

A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit i...

Pagekit 代码问题漏洞

Pagekit is a modular and lightweight CMS Content Management System developed under open source. Versions of Pagekit 1.0.18 and earlier have code vulnerabilities. These vulnerabilities stem from improper handling of parameters in the files/index.php/admin/system/update/download, which may lead to...

Xtool AnyScan App 安全漏洞

Xtool AnyScan App is an automotive diagnostic mobile application from China-based Xtool. A security vulnerability exists in Xtool AnyScan App version 4.40.40, which stems from a lack of authentication at the download endpoint of the update package...

Security Bulletin: NVIDIA License System - September 2025

NVIDIA has released an update for the Delegated License Service DLS component of NVIDIA License System to address a security issue that might lead to impacts described in this bulletin. To protect your system, download and install the latest version of the DLS. To simplify the upgrade of an...

The vulnerability of the SLNX PC Client of the embedded application and document management tool RICOH Streamline NX allows a perpetrator to elevate their privileges and execute arbitrary code.

The vulnerability of the SLNX PC Client of the embedded application and document management tool RICOH Streamline NX lies in the use of an unreliable data source during the download of updates. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary cod...

The vulnerability of the update download section for software solutions in the Spectrum Virtualize virtualization technology allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the update download section for Spectrum Virtualize software relates to insufficient protection of operational data during the download process. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information by using the “satask...

Sealevel Systems SeaConnect 370W 缓冲区错误漏洞

Sealevel Systems SeaConnect 370W is an Industrial Internet of Things Iiot edge device from Sealevel Systems, Inc. A buffer overflow vulnerability exists in Sealevel Systems SeaConnect 370W, which stems from the product's OTA Update u-download feature that does not effectively limit memory...

MS15-081: Description of the security update for Word 2013: August 11, 2015

Resolves vulnerabilities in Office that could allow remote code execution if a user opens a specially crafted Microsoft Office file.SummaryThis security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Microsoft Office...

CVE-2020-8809

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attack...

CVE-2020-8809

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attack...

November 13, 2018—KB4467701 (Monthly Rollup)

None None...

CVE-2018-10596 Medtronic 2090 Carelink Programmer Improper Restriction of Communication Channel to Intended Endpoints

Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this virtual private network before downloading updates. The affected products initially establish an encapsulated IP-based VPN connection to a...

December 13, 2016 — KB3205383 (OS Build 10240.17202)

None None...

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 GDR: November 8, 2016

None None...

Grandstream Wave Redirection Vulnerability

Grandstream Wave is a free VoIP application from Grandstream. The application supports multiple accounts, simultaneous use of multiple lines, and more. A redirection vulnerability exists in Grandstream Wave version 1.0.1.26, which originates when the program uses an unsecured connection to downlo...

Description of the Outlook Social Connector update (Oscmoss-x-none.msp): April 10, 2012

None None...

Design/Logic Flaw

Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrary web script via a leading 1 ftp or 2 http URI in the ReaderURL variable in the "Update Download Site" section of ads-readerext. NOTE: it is not clear whether the vendor advisory addresses this...

CVE-2006-1785

Adobe Document Server for Reader Extensions 6.0 is affected. Remote authenticated users can inject arbitrary web script via a leading ftp/http URI in the ReaderURL variable in the Update Download Site section of ads-readerext, per CVE-2006-1785. The description notes uncertainty about vendor advi...