PT-2023-11605 · Duxcms · Duxcms

Name of the Vulnerable Software and Affected Versions: DuxCMS version 2.1 Description: A directory traversal issue allows attackers to delete arbitrary files via the /admin/AdminBackup/del API endpoint. This enables attackers to potentially disrupt system functionality or destroy sensitive data...

Path traversal

Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are...

CVE-2023-35975

An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system...

Directory traversal

Directory traversal vulnerability in Snow Monkey Forms v5.1.1 and earlier allows a remote unauthenticated attacker to delete arbitrary files on the server...

NEC Aterm WG2200HP 路径遍历漏洞

The NEC Aterm WG2200HP is a wireless router from Nippon Electric NEC. A security vulnerability exists in the NEC Aterm WG2200HP that stems from the presence of a directory traversal vulnerability that could allow an authenticated attacker to delete specific files in the product...

CVE-2023-32521

A path traversal exists in a specific service dll of Trend Micro Mobile Security Enterprise 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files...

CVE-2023-32522

A path traversal exists in a specific dll of Trend Micro Mobile Security Enterprise 9.8 SP5 which could allow an authenticated remote attacker to delete arbitrary files. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit...

PT-2023-23076 · Vcd +2 · Vcd +2

Name of the Vulnerable Software and Affected Versions: Multiple Services versions affected versions not specified Description: The issue is related to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. This allows a malicious attacker to read...

Warning: GravityRAT Android Trojan Steals WhatsApp Backups and Deletes Files

An updated version of an Android remote access trojan dubbed GravityRAT has been found masquerading as messaging apps BingeChat and Chatico as part of a narrowly targeted campaign since June 2022. "Notable in the newly discovered campaign, GravityRAT can exfiltrate WhatsApp backups and receive...

PT-2023-7431 · Trend Micro · Trend Micro Mobile Security

Name of the Vulnerable Software and Affected Versions: Trend Micro Mobile Security Enterprise version 9.8 SP5 Description: A path traversal issue exists in a specific service dll, potentially allowing an unauthenticated remote attacker to delete arbitrary files. This is due to incorrect restricti...

CVE-2023-29152

By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account...

CVE-2020-36700

The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress...

PT-2023-22172 · Ptc · Vuforia

Name of the Vulnerable Software and Affected Versions: Vuforia affected versions not specified Description: The issue allows an attacker to delete any file with the permissions of the Vuforia server account by changing the filename parameter in the request. Recommendations: At the moment, there i...

ASUSTOR Data Master 路径遍历漏洞

ASUSTOR Data Master is an operating system exclusively on the ASUSTOR NAS from China's ASUS, featuring a tablet-like graphical interface comparable to a zero-learning curve, making it easy to get started right away. A security vulnerability exists in ASUSTOR Data Master ADM that stems from an...

PT-2023-23650 · Vipre · Vipre Antivirus Plus

Name of the Vulnerable Software and Affected Versions: VIPRE Antivirus Plus affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target syste...

PT-2023-13686 · Zte · Zte Mobile Phones

Name of the Vulnerable Software and Affected Versions: ZTE mobile phones affected versions not specified Description: The issue allows for unauthorized access, potentially enabling a malicious application to delete system files without user permission after being installed on the phone...

libarchive 竞争条件问题漏洞

libarchive is a multi-format archive and compression library. A security vulnerability exists in libarchive 3.6.2 and earlier versions, which stems from a problem with the archivewritediskposix.c file, and can be exploited by an attacker to delete or rename files in a directory...

CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...

CVE-2023-20172

Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about...