1127 matches found
CVE-2024-23472
SolarWinds Access Rights Manager ARM is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitrary read and delete files in ARM...
SolarWinds Access Rights Manager 路径遍历漏洞
SolarWinds Access Rights Manager is a lightweight review management system from SolarWinds. A path traversal vulnerability exists in SolarWinds Access Rights Manager that can be exploited by an attacker to arbitrarily read and delete files in ARM...
SolarWinds Access Rights Manager 路径遍历漏洞
SolarWinds Access Rights Manager is a tool for managing and auditing user access rights. A path traversal vulnerability exists in SolarWinds Access Rights Manager, which can be exploited by an attacker to delete critical files or access sensitive data...
CVE-2024-33879
An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter...
CVE-2024-5724 Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection
The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...
CVE-2024-4315
parisneo/lollms version 9.5 is vulnerable to Local File Inclusion LFI attacks due to insufficient path sanitization. The "sanitizepathfromendpoint" function fails to properly sanitize Windows-style paths backward slash "", allowing attackers to perform directory traversal attacks on Windows...
CVE-2024-4315: Improper Limitation of a Pathname to a Restricted Directory
parisneo/lollms version 9.5 is vulnerable to Local File Inclusion LFI attacks due to insufficient path sanitization. The sanitizepathfromendpoint function fails to properly sanitize Windows-style paths backward slash , allowing attackers to perform directory traversal attacks on Windows systems...
Schneider Electric Modicon M340 安全漏洞
The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric, France. A denial of service vulnerability exists in the Schneider Electric Modicon M340, which can be exploited by an attacker to prevent a use...
CVE-2024-32849
Trend Micro Security 17.x Consumer is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own...
SeaCMS Security Vulnerability
SeaCMS is a free, open source web content management system written in PHP. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 12.9. An attacker can exploit the vulnerability to delete files via admintemplate.php...
CVE-2024-5637
The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'removefiles' function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use path...
The vulnerability of the deleteFiles() function in the web application of the Common Service Desktop of the ultrasonic diagnostic system from GE Healthcare allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the deleteFiles function in the Common Service Desktop web application of GE HealthCare is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...
CVE-2024-35219: Improper Limitation of a Pathname to a Restricted Directory
OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary,...
CVE-2024-0453: Improper Access Control
The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openaifiledeletecallback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above...
CVE-2024-20868
Improper input validation in Samsung Notes prior to version 4.4.15 allows local attackers to delete files with Samsung Notes privilege under certain conditions...
CVE-2024-20868
Improper input validation in Samsung Notes prior to version 4.4.15 allows local attackers to delete files with Samsung Notes privilege under certain conditions...
CVE-2024-20868
Improper input validation in Samsung Notes prior to version 4.4.15 allows local attackers to delete files with Samsung Notes privilege under certain conditions...
HSC Cybersecurity HC Mailinspector 路径遍历漏洞
HSC Cybersecurity HC Mailinspector is a cloud email security solution from HSC Cybersecurity. A path traversal vulnerability exists in HSC Cybersecurity HC Mailinspector versions 5.2.17-3 through v.5.2.18, which stems from an unauthenticated path traversal vulnerability in mliRealtimeEmails.php,...
CVE-2024-3240 ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection
The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input from the 'settingsencoded' attribute of the 'smileinfobar' shortcode. This makes it possible for authenticated attackers, with...
CVE-2023-42099
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the...