Synology WebDAV Server 路径遍历漏洞

Synology WebDAV Server is an HTTP expansion service that allows users to edit and manage files stored on remote servers. A path traversal vulnerability exists in Synology WebDAV Server, which stems from an improper restriction of the pathname of a restricted directory by the webapi component, and...

PT-2022-18516 · Synology · Audio Station

Name of the Vulnerable Software and Affected Versions: Synology Audio Station versions prior to 6.5.4-3367 Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in the webapi component. This allows remo...

CVE-2022-27615

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in cgi component in Synology DNS Server before 2.2.2-5027 allows remote authenticated users to delete arbitrary files via unspecified vectors...

Synology DiskStation Manager 路径遍历漏洞

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. The operating system manages information such as data, files, photos, music, and more. A path traversal vulnerability exists in Synology DiskStation Manager DSM, whi...

CVE-2022-27610

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology DiskStation Manager DSM before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors...

CVE-2022-28877

This vulnerability allows local user to delete arbitrary file in the system and bypassing security protection which can be abused for local privilege escalation on affected F-Secure & WithSecure windows endpoint products. An attacker must have code execution rights on the victim machine prior to...

WithSecure Endpoint Protection 安全漏洞

WithSecure Endpoint Protection is a cloud-native, AI-powered endpoint protection from Finland's WithSecure. It can be deployed instantly from a browser and easily managed from a single console. WithSecure Endpoint Protection suffers from a security vulnerability that stems from allowing a local...

CVE-2022-30302

Multiple relative path traversal vulnerabilities CWE-23 in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 may allow a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web...

CVE-2022-30301

A path traversal vulnerability CWE-22 in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin user to delete and access unauthorized files and data via specifically crafted CLI commands...

CVE-2022-30301

A path traversal vulnerability CWE-22 in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin user to delete and access unauthorized files and data via specifically crafted CLI commands...

PT-2022-20197

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.0.0 through 5.9.1 Description The issue allows a remote authenticated attacker to bypass operation restrictions in multiple applications, enabling them to alter file information and/or delete files. Recommendations For...

PT-2022-5758

Name of the Vulnerable Software and Affected Versions FortiAP-U CLI versions 5.4.0 through 5.4.6 FortiAP-U CLI versions 6.0.0 through 6.0.4 FortiAP-U CLI versions 6.2.0 through 6.2.3 Description A path traversal vulnerability in FortiAP-U CLI is related to incorrect restriction of a directory pat...

Cybozu Garoon 授权问题漏洞

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. An authorization issue vulnerability exists in Cybozu Garoon. The vulnerability stems from improper privilege...

Path Traversal

concrete5/concrete5 is vulnerable to path traversal. The vulnerability exists because the getFileToImport function of file.php does not properly disable the chunk when uploading the files, allowing an attacker to access files outside the expected directory and delete the arbitrary files...

PT-2022-13971 · WordPress · Html2Wp

Name of the Vulnerable Software and Affected Versions: HTML2WP WordPress plugin version 1.0.0 Description: The issue is related to the lack of authorisation and CSRF checks in an AJAX action within the HTML2WP WordPress plugin. This could allow any authenticated user, including those with a...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link...

CODESYS 安全漏洞

CODESYS is a controller development system from Germany's 3S-Smart Software Solutions. A security vulnerability exists in several CODESYS products that arises from the implementation of incorrect error handling. A remote attacker with low privileges could exploit the vulnerability by crafting a...

Directory traversal

SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system...

CVE-2022-28478

SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system...

GHSA-HX79-X87C-HGM3 EC-CUBE Directory traversal vulnerability

Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...