CMS Made Simple has a deserialization vulnerability

CMS Made Simple is a simple, easy-to-use content management system developed using PHP, MySQL and Smarty template engine. A deserialization vulnerability exists in CMS Made Simple. An attacker can exploit the vulnerability to delete arbitrary files from the server...

CVE-2018-8968

An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock...

CVE-2018-7172

In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...

PT-2018-17928

Name of the Vulnerable Software and Affected Versions WonderCMS versions prior to 2.4.1 Description The issue allows remote attackers to delete arbitrary files via directory traversal in the index.php file. Recommendations For versions prior to 2.4.1, update to version 2.4.1 or later to resolve t...

DEBIAN-CVE-2011-2902

zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name...

PT-2018-4030

Name of the Vulnerable Software and Affected Versions xpdf versions prior to 3.02-19 xpdf version 3.02-12+squeeze1 Description The issue allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name, due to insecure temporary file deletion in zxpdf. Recommendations For xpdf...

PT-2018-17305

Name of the Vulnerable Software and Affected Versions NoneCms versions prior to 1.3.0 Description The issue allows remote authenticated users to delete arbitrary files by providing a .. in the param.path parameter, leveraging back-office access. This is a directory traversal vulnerability in the...

PT-2018-4268

Name of the Vulnerable Software and Affected Versions clipedit in the Clipboard module for Perl affected versions not specified Description The issue allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$. Recommendations At the moment, there is no information about ...

CVE-2017-2132: Improper Input Validation

Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB10004.47 allow an attacker to delete arbitrary files in a specific directory via unspecified vectors...

PT-2017-12459

Name of the Vulnerable Software and Affected Versions Cisco Network Analysis Module Software affected versions not specified Description The issue allows an unauthenticated, remote attacker to delete arbitrary files from an affected system due to a lack of proper input validation of HTTP requests...

PT-2017-6445

Name of the Vulnerable Software and Affected Versions texlive versions 3.1.20140525 r34255.fc21 and 6.20131226 r32488.fc20 Description The issue allows local users to delete arbitrary files via a crafted file in the user's home directory. This is due to a problem in the pre-install script in the...

CVE-2015-1865

fts.c in coreutils 8.4 allows local users to delete arbitrary files...

PT-2017-13178

Name of the Vulnerable Software and Affected Versions HPE BSM Platform Application Performance Management System Health versions 9.26, 9.30, 9.40 Description The issue allows remote users to delete arbitrary files via servlet directory traversal in the SHExportToExcel Servlet. Recommendations For...

CVE-2017-11382: Exposure of Resource to Wrong Sphere

Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. Formerly ZDI-CAN-4350...

PT-2017-12141

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request to the /dapur/apps/app config/controller/backuper.php endpoint...

CVE-2016-9250: Undefined Security Weakness

In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary files through an undisclosed mechanism...

PT-2017-3096

Name of the Vulnerable Software and Affected Versions Trend Micro Threat Discovery Appliance version 2.6.1062r1 Description The issue allows a remote, unauthenticated attacker to delete arbitrary files as root due to directory traversal when processing a session id cookie. This can be used to...

CVE-2017-5480

Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. dot dot in the fmselected array parameter...

PT-2017-16521

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 6.8.4 Description A directory traversal issue exists, allowing remote authenticated users to read or delete arbitrary files. This is achieved by providing a .. dot dot in the fm selected array parameter in the...

PT-2017-10097

Name of the Vulnerable Software and Affected Versions Xen affected versions not specified Description The issue allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host. This is achieved through string quotes and S-expressions in the bootloader configuration...