CVE-2021-25155: Undefined Security Weakness

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below...

PT-2021-16433

Name of the Vulnerable Software and Affected Versions: Aruba Instant versions 6.4.x: 6.4.4.8 through 4.2.4.17 and below Aruba Instant versions 6.5.x: 6.5.4.18 and below Aruba Instant versions 8.3.x: 8.3.0.14 and below Aruba Instant versions 8.5.x: 8.5.0.11 and below Aruba Instant versions 8.6.x:...

CVE-2021-25160: Undefined Security Weakness

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below...

Aruba Access Points: Input validation vulnerability

Aruba Instant is a cloud-hosted controller-less wireless access point. Aruba Instant suffers from an arbitrary file modification vulnerability that can be exploited by an attacker via a command line interface to overwrite arbitrary files with content under their control...

PT-2021-16423

Name of the Vulnerable Software and Affected Versions: Aruba Instant versions 6.5.4.17 and below Aruba Instant versions 8.3.0.13 and below Aruba Instant versions 8.5.0.10 and below Aruba Instant versions 8.6.0.4 and below Description: A remote arbitrary file modification issue was discovered in...

Aruba Access Points: Input validation vulnerability

Aruba Instant is a cloud-hosted controller-less wireless access point. Aruba Instant suffers from an arbitrary file modification vulnerability that can be exploited by an attacker via the Web UI to overwrite arbitrary files with content under their control...

CVE-2021-25148: Undefined Security Weakness

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point IAP products in versions: Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.4 and below. Aruba h...

Security vulnerabilities in Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches

Cisco NX-OS Software and so on are products of Cisco Corporation.Cisco NX-OS Software is a set of data center-grade operating system software used by switches.Cisco Nexus 3000 Series Switches is a 3000 series switch.Cisco Nexus 9000 Series Switches is a 9000 series switch. A security vulnerabilit...

CVE-2021-23876 McAfee Total Protection (MTP) Bypass Remote Procedure call vulnerability

Bypass Remote Procedure call in McAfee Total Protection MTP prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file modification as the SYSTEM user potentially causing Denial of Service via executing carefully constructed malware...

CVE-2021-23876: Improper Privilege Management

Bypass Remote Procedure call in McAfee Total Protection MTP prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file modification as the SYSTEM user potentially causing Denial of Service via executing carefully constructed malware...

CVE-2020-35948: Incorrect Authorization

An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xclonerrestore.php writefileaction could...

CVE-2020-8258

Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, allows an attacker to modify arbitrary files...

CVE-2020-8258

Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, allows an attacker to modify arbitrary files...

CVE-2020-8258: Improper Privilege Management

Improper privilege management on services run by Citrix Gateway Plug-in for Windows, versions before and including 13.0-61.48 and 12.1-58.15, allows an attacker to modify arbitrary files...

Child Theme Creator by Orbisius < 1.5.2 - CSRF to Arbitrary File Modification/Creation

This flaw gave attackers the ability to forge requests on behalf of an administrator in order to modify arbitrary theme files and create new PHP files, which could allow an attacker to achieve remote code execution RCE on a vulnerable site’s server. The following will create hello.php in the...

Child Theme Creator by Orbisius < 1.5.2 - CSRF to Arbitrary File Modification/Creation

This flaw gave attackers the ability to forge requests on behalf of an administrator in order to modify arbitrary theme files and create new PHP files, which could allow an attacker to achieve remote code execution RCE on a vulnerable site’s server. PoC The following will create hello.php in the...

WordPress Child Theme Creator by Orbisius plugin <= 1.5.1 - Cross-Site Request Forgery (CSRF) to Arbitrary File Modification/Creation vulnerability

Cross-Site Request Forgery CSRF to Arbitrary File Modification/Creation vulnerability found by Chloe Chamberland in WordPress Child Theme Creator by Orbisius plugin versions = 1.5.1. Solution Update the WordPress Child Theme Creator by Orbisius plugin to the latest available version at least 1.5....

CVE-2020-7119: Undefined Security Weakness

A vulnerability exists in the Aruba Analytics and Location Engine ALE web management interface 2.1.0.2 and earlier firmware that allows an already authenticated administrative user to arbitrarily modify files as an underlying privileged operating system user...

PT-2020-19385

Name of the Vulnerable Software and Affected Versions Aruba Analytics and Location Engine ALE versions 2.1.0.2 and earlier Description A vulnerability exists in the Aruba Analytics and Location Engine ALE web management interface that allows an already authenticated administrative user to...

PT-2020-19637

Name of the Vulnerable Software and Affected Versions Automation License Manager 5 all versions Automation License Manager 6 versions prior to 6.0.8 Description A security issue has been found where the application fails to properly validate user privileges during certain operations. This could...