CVE-2023-26563

The Syncfusion EJ2 Node File Provider 0102271 is vulnerable to filesystem-server.js directory traversal. As a result, an unauthenticated attacker can: - On Windows, list files in any directory, read any file, delete any file, upload any file to any directory accessible by the web server. - On...

GHSA-2Q4P-F6GF-MQR5 Graylog server has partial path traversal vulnerability in Support Bundle feature

A partial path traversal vulnerability exists in Graylog's Support Bundle feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource. Thanks to weiweiwei9811 for reporting this vulnerability and providing detailed information. Impact Graylog's Support Bundle...

CVE-2020-21862

Directory traversal vulnerability in DuxCMS 2.1 allows attackers to delete arbitrary files via /admin/AdminBackup/del...

PT-2023-11605 · Duxcms · Duxcms

Name of the Vulnerable Software and Affected Versions: DuxCMS version 2.1 Description: A directory traversal issue allows attackers to delete arbitrary files via the /admin/AdminBackup/del API endpoint. This enables attackers to potentially disrupt system functionality or destroy sensitive data...

Path traversal

Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are...

CVE-2023-35975

An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system...

Directory traversal

Directory traversal vulnerability in Snow Monkey Forms v5.1.1 and earlier allows a remote unauthenticated attacker to delete arbitrary files on the server...

NEC Aterm WG2200HP 路径遍历漏洞

The NEC Aterm WG2200HP is a wireless router from Nippon Electric NEC. A security vulnerability exists in the NEC Aterm WG2200HP that stems from the presence of a directory traversal vulnerability that could allow an authenticated attacker to delete specific files in the product...

CVE-2023-32522

A path traversal exists in a specific dll of Trend Micro Mobile Security Enterprise 9.8 SP5 which could allow an authenticated remote attacker to delete arbitrary files. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit...

CVE-2023-32521

A path traversal exists in a specific service dll of Trend Micro Mobile Security Enterprise 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files...

PT-2023-23076 · Vcd +2 · Vcd +2

Name of the Vulnerable Software and Affected Versions: Multiple Services versions affected versions not specified Description: The issue is related to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. This allows a malicious attacker to read...

Warning: GravityRAT Android Trojan Steals WhatsApp Backups and Deletes Files

An updated version of an Android remote access trojan dubbed GravityRAT has been found masquerading as messaging apps BingeChat and Chatico as part of a narrowly targeted campaign since June 2022. "Notable in the newly discovered campaign, GravityRAT can exfiltrate WhatsApp backups and receive...

PT-2023-7431 · Trend Micro · Trend Micro Mobile Security

Name of the Vulnerable Software and Affected Versions: Trend Micro Mobile Security Enterprise version 9.8 SP5 Description: A path traversal issue exists in a specific service dll, potentially allowing an unauthenticated remote attacker to delete arbitrary files. This is due to incorrect restricti...

CVE-2023-29152

By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account...

CVE-2020-36700

The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress...

PT-2023-22172 · Ptc · Vuforia

Name of the Vulnerable Software and Affected Versions: Vuforia affected versions not specified Description: The issue allows an attacker to delete any file with the permissions of the Vuforia server account by changing the filename parameter in the request. Recommendations: At the moment, there i...

PT-2023-11842

Name of the Vulnerable Software and Affected Versions The Page Builder: KingComposer plugin for WordPress versions up to, and including, 2.9.3 Description The issue is related to authorization bypass due to a security nonce being leaked in the '/wp-admin/index.php' page. This allows authenticated...

CVE-2020-36700: Improper Access Control

The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress...

ASUSTOR Data Master 路径遍历漏洞

ASUSTOR Data Master is an operating system exclusively on the ASUSTOR NAS from China's ASUS, featuring a tablet-like graphical interface comparable to a zero-learning curve, making it easy to get started right away. A security vulnerability exists in ASUSTOR Data Master ADM that stems from an...

PT-2023-23650 · Vipre · Vipre Antivirus Plus

Name of the Vulnerable Software and Affected Versions: VIPRE Antivirus Plus affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target syste...