Path traversal

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause arbitrary file deletion upon service restart when accessed by a local and low-privileged attacker...

CVE-2023-6407

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause arbitrary file deletion upon service restart when accessed by a local and low-privileged attacker...

CVE-2023-6407

The CVE-2023-6407 issue, assigned to Schneider Electric Easy UPS Online Monitoring Software, is a path traversal vulnerability in the Windows-based Easy UPS Online Monitoring Software. Affected versions are 2.6-GA-01-23116 and earlier; Schneider Electric released a fix in 2.6-GA-01-23248. Root ca...

CVE-2023-6407

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause arbitrary file deletion upon service restart when accessed by a local and low-privileged attacker...

Jenkins plugins Multiple Vulnerabilities (2023-12-13)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lea...

Information disclosure

Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of...

Arbitrary file deletion vulnerability in Jenkins Scriptler Plugin

Jenkins Scriptler Plugin 342.v6a89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system...

CVE-2023-50764

Jenkins Scriptler Plugin 342.v6a89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system...

Design/Logic Flaw

Jenkins Scriptler Plugin 342.v6a89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system...

CVE-2023-50774

A cross-site request forgery CSRF vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system...

CVE-2023-50764

Jenkins Scriptler Plugin 342.v6a89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system...

CVE-2023-50764

Jenkins Scriptler Plugin 342.v6a89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system...

Jenkins Scriptler Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Schneider Electric Easy UPS Online Monitoring Software Path Traversal Vulnerability

Schneider Electric Easy UPS Online Monitoring Software is a power monitoring software from Schneider Electric France. A path traversal vulnerability exists in Schneider Electric Easy UPS Online Monitoring Software. An attacker could exploit this vulnerability to cause arbitrary file deletion upon...

Jenkins HTMLResource Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-31633 · Jenkins · Jenkins Scriptler Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Scriptler Plugin versions 342.v6a 89fd40f466 and earlier Description: The issue allows attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system due to a lack of restriction on a fil...

Import and export users and customers < 1.24.3 - Admin+ Arbitrary File Read/Deletion

Description The plugin is vulnerable to Directory Traversal via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain...

Improper Link Resolution Before File Access (Leaky Vessels)

Overview Affected versions of this package are vulnerable to Improper Link Resolution Before File Access Leaky Vessels allowing arbitrary file deletion on the host system. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for th...

Code injection

Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link...

PYSEC-2023-292

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if...