982 matches found
PT-2024-37491 · Malwarebytes · Malwarebytes Antimalware
Name of the Vulnerable Software and Affected Versions: Malwarebytes Antimalware affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute...
CVE-2024-7435
The Attire theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is prese...
CVE-2024-5941
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handlerequest' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers,...
PT-2024-9472 · Veeam · Veeam Backup & Replication
Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: The issue is related to insecure deserialization in Veeam Backup & Replication, allowing a low-privileged user to connect to remoting services and exploit this...
PT-2024-6400 · Eset · Eset
Name of the Vulnerable Software and Affected Versions: ESET versions prior to the fixed version Description: The issue is related to insufficient access control in ESET's antivirus protection, potentially allowing an attacker to misuse file operations during the removal of a detected file on the...
PT-2024-37487 · Unknown · Gaizhenbiao/Chuanhuchatgpt
Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version 20240410 Description: A vulnerability in the JSON file handling allows any user to delete any JSON file on the server, including critical configuration files such as config.json and ds config chatbot.json...
PT-2024-38202 · Panda Security · Panda Security Dome
Name of the Vulnerable Software and Affected Versions: Panda Security Dome affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged co...
PT-2024-38189 · Avast · Avast Cleanup Premium
Name of the Vulnerable Software and Affected Versions: Avast Cleanup Premium affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of Avast Cleanup Premium. An attacker must first obtain the ability to execute low-privilege...
CVE-2024-27489
The CVE-2024-27489 issue affects WMCMS v4.4 and is tied to the DelFile() function, which allows an attacker to delete arbitrary files via a crafted POST request. Sources consistently describe the vulnerability as a file-deletion flaw in DelFile(), with confirmed references from Red Hat and NVD in...
CVE-2024-23472
SolarWinds Access Rights Manager ARM is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitrary read and delete files in ARM...
SolarWinds Access Rights Manager 路径遍历漏洞
SolarWinds Access Rights Manager is a tool for managing and auditing user access rights. A path traversal vulnerability exists in SolarWinds Access Rights Manager, which can be exploited by an attacker to delete critical files or access sensitive data...
SolarWinds Access Rights Manager 路径遍历漏洞
SolarWinds Access Rights Manager is a lightweight review management system from SolarWinds. A path traversal vulnerability exists in SolarWinds Access Rights Manager that can be exploited by an attacker to arbitrarily read and delete files in ARM...
CVE-2024-33879
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter...
CVE-2024-5724 Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection
The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...
Schneider Electric Modicon M340 安全漏洞
The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric, France. A denial of service vulnerability exists in the Schneider Electric Modicon M340, which can be exploited by an attacker to prevent a use...
CVE-2024-32849
Trend Micro Security 17.x Consumer is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own...
SeaCMS Security Vulnerability
SeaCMS is a free, open source web content management system written in PHP. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 12.9. An attacker can exploit the vulnerability to delete files via admintemplate.php...
CVE-2024-5637
The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'removefiles' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use path...
The vulnerability of the deleteFiles() function in the web application of the Common Service Desktop of the ultrasonic diagnostic system from GE Healthcare allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the deleteFiles function in the Common Service Desktop web application of GE HealthCare is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...