254 matches found
CVE-2025-35053 Newforma Info Exchange (NIX) arbitrary file read and delete
Newforma Info Exchange NIX accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' privileges. In Newforma before 2023.1, anonymous access is enabl...
CVE-2025-35053
Summary of findings (CVE-2025-35053): Newforma Info Exchange (NIX) exposes a vulnerability in the endpoint "/UserWeb/Common/MarkupServices.ashx" where the command DownloadExportedPDF allows an authenticated user to read and delete arbitrary files with the NT AUTHORITY\NetworkService privileges. T...
EUVD-2020-5769
Malware in sbrugna...
EUVD-2017-17795
Malware in sbrugna...
EUVD-2022-35273
Malicious code in bioql PyPI...
EUVD-2022-5907
Malicious code in bioql PyPI...
EUVD-2024-51021
Malicious code in bioql PyPI...
EUVD-2024-2941
Malicious code in bioql PyPI...
EUVD-2024-51018
Malicious code in bioql PyPI...
EUVD-2023-27784
Malicious code in bioql PyPI...
EUVD-2024-22271
Malicious code in bioql PyPI...
EUVD-2022-48556
Malicious code in bioql PyPI...
EUVD-2023-43839
Malicious code in bioql PyPI...
EUVD-2023-30748
Malicious code in bioql PyPI...
EUVD-2023-31774
Malicious code in bioql PyPI...
CVE-2025-20259
Multiple vulnerabilities in the update process of Cisco ThousandEyes Endpoint Agent for Windows could allow an authenticated, local attacker to delete arbitrary files on an affected device. These vulnerabilities are due to improper access controls on files that are in the local file system. An...
CVE-2023-26957
onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...
CVE-2023-3155
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the galleryedit function, allowing an attacker to access arbitrary resources on the server...
CVE-2022-30117
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...