CVE-2024-34191

HTMly version 2.9.6 is affected by CVE-2024-34191, a vulnerability in delete_post() (admin.php) that enables arbitrary file deletion via a crafted request. The issue is documented across multiple sources (NVD/Red Hat OSV, etc.), with a CVSS v3.1 base score of 6.5 (I: High, A: None) and an attack ...

CVE-2024-34191

htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the deletepost function at admin.php. This vulnerability allows attackers to delete arbitrary files via a crafted request...

CVE-2024-3037 Arbitrary File Deletion in PaperCut NG/MF Web Print

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege...

CVE-2024-3037 Arbitrary File Deletion in PaperCut NG/MF Web Print

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege...

PT-2024-24107 · Aruba · Aruba Access Point

Name of the Vulnerable Software and Affected Versions: Aruba Access Point affected versions not specified Description: The issue is related to an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI Aruba's access point management protocol. Successful...

Aruba Networks ArubaOS 和 InstantOS 安全漏洞

Aruba Networks ArubaOS and Aruba Networks InstantOS are both products of Aruba Networks, Inc.Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks, including Mobility Controllers and Mobility Access Switches. Aruba Networks InstantOS is an Arch Linux-based distribution...

PaperCut NG和PaperCut MF 后置链接漏洞

PaperCut MF and PaperCut NG are both products of PaperCut Australia.PaperCut MF is a multifunctional printer control software.PaperCut NG is a next-generation printer control software. PaperCut NG and PaperCut MF have a backlink vulnerability that originates from allowing the deletion of arbitrar...

Aruba Networks ArubaOS 和 InstantOS 安全漏洞

Aruba Networks ArubaOS and Aruba Networks InstantOS are both products of Aruba Networks, Inc.Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks, including Mobility Controllers and Mobility Access Switches. Aruba Networks InstantOS is an Arch Linux-based distribution...

PT-2024-24106 · Aruba · Aruba Access Point

Name of the Vulnerable Software and Affected Versions: Aruba Access Point affected versions not specified Description: The issue concerns an arbitrary file deletion vulnerability in the CLI service accessed by PAPI, which is Aruba's Access Point management protocol. Successful exploitation of thi...

htmly 安全漏洞

HTMLy is a PHP-based open source blogging platform. A security vulnerability exists in htmly version v2.9.6, which stems from the presence of an arbitrary file deletion vulnerability that allows an attacker to delete arbitrary files via a crafted request...

RHEL 7 : xstream (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulati...

CVE-2024-4413 Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection

The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugi...

Dell PowerProtect DM5500 Directory Traversal Vulnerability

Dell PowerProtect DM5500 is an integrated solution from Dell, Inc. It provides industry-leading deduplication, data protection solutions and multi-cloud capabilities. A directory traversal vulnerability exists in Dell PowerProtect DM5500 version 5.15.0.0 and prior versions, which can be exploited...

CVE-2024-2290

CVE-2024-2290 : Advanced Ads – Ad Manager & AdSense for WordPress (up to 1.52.1) is vulnerable to PHP Object Injection via deserialization of untrusted input in the placement_slug parameter. The issue enables authenticated attackers to inject a PHP object. The Red Hat advisory and Wordfence note ...

CVE-2024-24908

Dell PowerProtect DM5500 version 5.15.0.0 and prior contain an Arbitrary File Delete via Path Traversal vulnerability. A remote attacker with high privileges could potentially exploit this vulnerability to deletion of arbitrary files stored on the server filesystem...

PT-2024-20659 · Dell · Dell Powerprotect Dm5500

Name of the Vulnerable Software and Affected Versions: Dell PowerProtect DM5500 versions 5.15.0.0 and prior Description: The issue allows a remote attacker with high privileges to potentially exploit an Arbitrary File Delete via Path Traversal vulnerability, leading to the deletion of arbitrary...

CVE-2024-4346

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to...

CVE-2024-4346 Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to...

CVE-2024-4346 Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to...

CVE-2024-4346

The CVE-2024-4346 entry concerns the Startklar Elementor Addons for WordPress, which allows unauthenticated arbitrary file deletion due to improper path validation during file handling. The vulnerability affects all versions up to 1.7.13 and can delete critical files (including wp-config.php), en...