10763 matches found
ABB Cylon Aspect 3.08.01 calendarFileDelete.php Arbitrary File Deletion
ABB Cylon Aspect 3.08.01 calendarFileDelete.php Arbitrary File Deletion Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy...
CVE-2024-47818
Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/cleansyncdir endpoint. The dirname POST parameter is not validated/sanitized and is used to construct the syncDir that is...
CVE-2024-47818 Logged-in users with any role can delete arbitrary files in @saltcorn/server
Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/cleansyncdir endpoint. The dirname POST parameter is not validated/sanitized and is used to construct the syncDir that is...
CVE-2024-47818
CVE-2024-47818 affects Saltcorn, exposing a path traversal/file deletion vulnerability in the internal endpoint POST /sync/clean_sync_dir. The issue stems from the lack of validation/sanitization of the dir_name parameter, which is used to build a filesystem path under rootFolder/location/mobile_...
CVE-2024-47818 Logged-in users with any role can delete arbitrary files in @saltcorn/server
Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/cleansyncdir endpoint. The dirname POST parameter is not validated/sanitized and is used to construct the syncDir that is...
CVE-2024-47818 Logged-in users with any role can delete arbitrary files in @saltcorn/server
Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/cleansyncdir endpoint. The dirname POST parameter is not validated/sanitized and is used to construct the syncDir that is...
CVE-2024-45894
BlueCMS 1.6 suffers from Arbitrary File Deletion via the filename parameter in an /admin/database.php?act=del request...
Mecha CMS 安全漏洞
Mecha CMS is a Mecha open source flat file content management system for minimalists. A security vulnerability exists in Mecha CMS version 3.0.0 that stems from vulnerability to directory traversal attacks. An attacker can construct cookies and URIs that bypass user identity checks and then pass...
CVE-2024-45894
BlueCMS 1.6 suffers from Arbitrary File Deletion via the filename parameter in an /admin/database.php?act=del request...
BlueCMS 安全漏洞
BlueCMS is a content management system CMS based on PHP and MySQL. A security vulnerability exists in BlueCMS version 1.6, which originates from arbitrary file deletion via the filename parameter in the /admin/database.php?act=del request...
CVE-2024-45894
BlueCMS 1.6 suffers from Arbitrary File Deletion via the filename parameter in an /admin/database.php?act=del request...
ABB Cylon Aspect 3.08.01 (calendarFileDelete.php) Arbitrary File Deletion
Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The BMS/BAS controller suffers from an arbitrary file deletion...
CVE-2024-45894
CVE-2024-45894 affects BlueCMS 1.6, enabling Arbitrary File Deletion via the file_name parameter in the /admin/database.php?act=del endpoint. The underlying issue is that the parameter allows deletions of arbitrary files, exposing potential file-impact risks. Remediation guidance in the connected...
PT-2024-31842 · Bluecms · Bluecms
Name of the Vulnerable Software and Affected Versions: BlueCMS version 1.6 Description: The issue allows for Arbitrary File Deletion through the file name parameter in an "/admin/database.php?act=del" request. This flaw can be exploited to delete files arbitrarily. Recommendations: For BlueCMS...
PT-2024-31991 · Mecha Cms · Mecha Cms
Name of the Vulnerable Software and Affected Versions: Mecha CMS version 3.0.0 Description: The issue allows an attacker to construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the deletion of arbitrary files or website...
CVE-2024-45894
BlueCMS 1.6 suffers from Arbitrary File Deletion via the filename parameter in an /admin/database.php?act=del request...
CVE-2024-9314
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'setredirections' function. This makes it possible for authenticated attackers, with...
CVE-2024-20477 Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability
A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could...
CVE-2024-20477 Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability
A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could...
