982 matches found
Path Traversal
concrete5/concrete5 is vulnerable to path traversal. The vulnerability exists because the getFileToImport function of file.php does not properly disable the chunk when uploading the files, allowing an attacker to access files outside the expected directory and delete the arbitrary files...
PT-2022-13971 · WordPress · Html2Wp
Name of the Vulnerable Software and Affected Versions: HTML2WP WordPress plugin version 1.0.0 Description: The issue is related to the lack of authorisation and CSRF checks in an AJAX action within the HTML2WP WordPress plugin. This could allow any authenticated user, including those with a...
Cross site request forgery (csrf)
A Cross-Site Request Forgery CSRF in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link...
CODESYS 安全漏洞
CODESYS is a controller development system from Germany's 3S-Smart Software Solutions. A security vulnerability exists in several CODESYS products that arises from the implementation of incorrect error handling. A remote attacker with low privileges could exploit the vulnerability by crafting a...
Directory traversal
SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system...
CVE-2022-28478
SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system...
EC-CUBE Directory traversal vulnerability
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...
GHSA-HX79-X87C-HGM3 EC-CUBE Directory traversal vulnerability
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...
ROS-20220524-03
The cURL command-line utility vulnerability is related to the -no-clobber toolkit, which is used in conjunction with --remove-on-error. Exploitation of the vulnerability could allow an attacker acting remotely, trick the victim into connecting to a malicious server and forcing the command-line to...
Apple iTunes 权限许可和访问控制问题漏洞
Apple iTunes is a suite of media player applications from Apple Inc. that are used to play and manage digital music and video files. A permission and access control issue exists in Apple iTunes Mobile Device Service, which arises from the application not properly securing the mobile device servic...
elFinder Path Traversal vulnerability
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...
GHSA-45X3-MW7Q-WF7F elFinder Path Traversal vulnerability
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...
Schneider Electric Cleartext Transmission of Sensitive Information in embedded Rockwell Automation ISaGRAF5 Runtime (CVE-2020-25178)
ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote...
GHSA-8MW8-J583-VQFG RubyGems passenger gem allows remote attackers to delete files
RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. Affects both open source and Enterprise versions 4.0.0.beta1, 4.0.0.beta2...
RiteCMS path traversal vulnerability
RiteCMS is a web CMS. A path traversal vulnerability exists in RiteCM, which can be exploited by an authenticated attacker to delete any file in the web root directory...
Pillow Input Validation Error Vulnerability (CNVD-2022-28799)
Pillow is a Python based image processing library. An input validation error vulnerability exists in versions of Pillow prior to 9.0.1, which stems from the product's remove operation not validating user input data, and can be exploited by an attacker to delete files...
CVE-2022-27840
Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsungRecovery permission...
Improper access control
Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsungRecovery permission...