304 matches found
CVE-2018-13407
A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused...
CVE-2018-13407: Cross-Site Request Forgery (CSRF)
A CSRF issue was discovered in Jirafeau before 3.4.1. The "delete file" feature on the admin panel is not protected against automated requests and could be abused...
PT-2018-11804
Name of the Vulnerable Software and Affected Versions Jirafeau versions prior to 3.4.1 Description A CSRF issue was discovered in the "delete file" feature on the admin panel, which is not protected against automated requests and could be abused. Recommendations For versions prior to 3.4.1, updat...
CVE-2018-13122
onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete Files screen, as demonstrated by a ?i=var/www/html/&f=123.php&p=edit&p=deletefile URI...
Code injection
onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete Files screen, as demonstrated by a ?i=var/www/html/&f=123.php&p=edit&p=deletefile URI...
CVE-2018-13122: Incorrect Permission Assignment for Critical Resource
onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete Files screen, as demonstrated by a ?i=var/www/html/&f=123.php&p=edit&p=deletefile URI...
CVE-2017-7796
On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file...
Design/Logic Flaw
On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file...
CVE-2017-11183
front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter...
Composr CMS v10.0.0 XSS Vulnerability
Composr CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:composr:cms";...
CVE-2017-6637
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software prior to Release 11.1 could allow an authenticated, remote attacker to delete any file from an affected system. The vulnerability exists because the affected software does not perform proper input validation o...
CVE-2017-6576
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta aka mail-masta plugin 1.0 for WordPress. This affects ./inc/campaign/campaign-delete.php with the GET Parameter: id...
Pluck 4.7.3 - (Delete File) CSRF Web Vulnerability
Document Title: =============== Pluck 4.7.3 - Delete File CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1980 Release Date: ============= 2016-10-16 Vulnerability Laboratory ID VL-ID: ==================================== 1980...
jbFileManager - Directory Traversal
Exploit for php platform in category web applications Exploit Title: jbFileManager - Path Traversalview/add/delete Date: 2016-06-15 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: https://github.com/ismiranda/jbFileManager Software Link:...
HackerOne: Previous attachments can be referenced when creating a new report
Hello When user upload file in comment to report, user can find file ID by two ways: 1. In preview mode - In response to POST method https://hackerone.com/attachments , answer will be something like this: -"id":84577,"name":"mytestfile.png","size":32397 where fileID = 84577 for example 2. If user...
phpmyfamily - Multiple Vulnerabilities
No description provided by source. ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub-17-phpmyfamily-multiple-remote-vulnerabilities/ ''' - Title : phpmyfamily Multiple Remote Vulnerabilities. -...
Linux - setreuid (0,0) & execve(/bin/rm /etc/shadow)
No description provided by source. / rmtheshadow.c by mrme Just for fun : visit: http://www.corelan.be:8800/ / include stdio.h include string.h char sc = x31xc0 // xor %eax,%eax xb0x46 // mov $046,%al x31xdb // xor %ebx,%ebx x31xc9 // xor %ecx,%ecx xcdx80 // int $080 x31xc0 // xor %eax,%eax x50 /...
Telnet-Ftp Service Server 1.x - Multiple Vulnerabilities (Post Auth)
No description provided by source. / Telnet-Ftp Service Server v1.x ------------------------------ Multiple Vulnerability: -Remote Creat File -Remote Delet File -Remote Creat Directory -Remote Delet Directory -Remote Get File -Remote Crash...
Moodle CMS 2.5.0-1 Cross Site Scripting
============================================= - Original release date: 15 September, 2013 - Discovered by: Emilio Pinna Application Security Analyst at Abinsula - Contact: emilio pinn gmail ============================================= VULNERABILITY ---------------------- Moodle CMS version 2.5.0...
