Path traversal

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path...

Arbitrary file deletion

An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root of the application to gain access to the server via the web shell...

PT-2023-16283 · Unknown · Orangescrum

Name of the Vulnerable Software and Affected Versions: OrangeScrum version 2.0.11 Description: The issue allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to constru...

CVE-2023-0454

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path...

lmxcms 路径遍历漏洞

lmxcms dream cms is a website builder from China Dream Cms lmxcms company. There is a security vulnerability in lmxcms v1.41, which originated from the discovery of an arbitrary file deletion vulnerability via BackdbAction.class.php...

CVE-2023-23136

lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php...

CVE-2023-23136

The provided connected documents confirm a concrete vulnerability in lmxcms v1.41: an arbitrary file deletion issue exploitable via BackdbAction.class.php. The attack surface is the BackdbAction component, with impact described as high on integrity and availability while confidentiality remains u...

Siretta QUARTZ-GOLD Directory Traversal Vulnerability

Siretta QUARTZ-GOLD is an industrial router with multiple features and services.A directory traversal vulnerability exists in Siretta QUARTZ-GOLD, which can be exploited by attackers to cause arbitrary file deletion by sending specially crafted network packets...

CVE-2023-23136

lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php...

CVE-2023-0454

OrangeScrum 2.0.11 is affected by a path traversal vulnerability. An authenticated external attacker can delete arbitrary local files on the server due to an unsanitized attacker-controlled parameter used to construct internal paths. The CVE-2023-0454 entry does not specify a remediation in the p...

CVE-2023-23924

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing tags with uppercase letters. This may lead to arbitrary object unserialize on PHP 8, through the phar URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with...

CVE-2023-23924 URI validation failure on SVG parsing in Dompdf

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing tags with uppercase letters. This may lead to arbitrary object unserialize on PHP 8, through the phar URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with...

CVE-2023-23924 URI validation failure on SVG parsing in Dompdf

Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing tags with uppercase letters. This may lead to arbitrary object unserialize on PHP 8, through the phar URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with...

PT-2023-1267 · Dompdf +1 · Dompdf +1

Name of the Vulnerable Software and Affected Versions: Dompdf version 2.0.1 Dompdf versions prior to 8.0.0 Description: The issue is related to the incorrect order of authorization checks before syntax analysis and canonization when processing tags with uppercase letters in SVG parsing. This can...

VMSA-2023-0003:VMware Workstation update addresses an arbitrary file deletion vulnerability

Advisory ID: VMSA-2023-0003 CVSSv3 Range: 7.8 Issue Date:2023-02-02 Updated On: 2023-02-02 Initial Advisory CVEs: CVE-2023-20854 Synopsis: VMware Workstation update addresses an arbitrary file deletion vulnerability CVE-2023-20854 RSS Feed Download PDF Download Text File Share this page on social...

Siretta QUARTZ-GOLD Directory Traversal Vulnerability (CNVD-2023-17076)

Siretta QUARTZ-GOLD is a high-speed dual-port Gigabit Ethernet industrial router from Siretta.The Siretta QUARTZ-GOLD is vulnerable to a directory traversal vulnerability that could be exploited by an attacker to send specially crafted HTTP requests resulting in arbitrary file deletion...

CVE-2021-41143 OpenMage LTS arbitrary file deletion in customer media allows for remote code execution

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue...

CVE-2021-41143 OpenMage LTS arbitrary file deletion in customer media allows for remote code execution

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue...

Fix for arbitrary file deletion in customer media allows for remote code execution

Impact Magento admin users with access to the customer media could execute code on the server...

GHSA-5VPV-XMCJ-9Q85 Fix for arbitrary file deletion in customer media allows for remote code execution

Impact Magento admin users with access to the customer media could execute code on the server...