CVE-2018-20437

An issue was discovered in the fileDownload function in the CommonController class in FEBS-Shiro before 2018-11-05. An attacker can download a file via a request of the form /common/download?filename=1.jsp&delete=false. NOTE: the software maintainer disputes the significance of this report because the product uses a JAR archive for deployment, and this contains application.yml with configuration data

• CWE-22

• https://github.com/wuyouzhuguli/FEBS-Shiro/commit/9a753215b0969a5d5b5bfe8c68585339fee96260Patch, Third Party Advisory
• https://github.com/wuyouzhuguli/FEBS-Shiro/commit/a9706b1b3c96bacece24886429b4423c3a467acdPatch, Third Party Advisory
• https://github.com/wuyouzhuguli/FEBS-Shiro/issues/40Exploit, Third Party Advisory
• https://github.com/wuyouzhuguli/FEBS-Shiro/commit/9a753215b0969a5d5b5bfe8c68585339fee96260Patch, Third Party Advisory
• https://github.com/wuyouzhuguli/FEBS-Shiro/commit/a9706b1b3c96bacece24886429b4423c3a467acdPatch, Third Party Advisory
• https://github.com/wuyouzhuguli/FEBS-Shiro/issues/40Exploit, Third Party Advisory

Published

Dec 25, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20430GNU Libextractor through 1.8 has an out-of-bounds read vulne…
• CVE-2018-20431GNU Libextractor through 1.8 has a NULL Pointer Dereference …
• CVE-2018-20432D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use…9.8
• CVE-2018-20433c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream i…
• CVE-2018-20434LibreNMS 1.46 allows remote attackers to execute arbitrary O…
• CVE-2018-20436The "secret chat" feature in Telegram 4.9.1 for Android has …
• CVE-2018-20438Technicolor TC7110.AR STD3.38.03 devices allow remote attack…
• CVE-2018-20439Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-17021…
• CVE-2018-2044Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20440Technicolor CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC devi…
• CVE-2018-20441Technicolor TC7200.TH2v2 SC05.00.22 devices allow remote att…
• CVE-2018-20442Technicolor TC7110.B STC8.62.02 devices allow remote attacke…