CVE-2020-29177

Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \appdel.php...

Arbitrary file deletion

Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \appdel.php...

CVE-2020-29177

Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \appdel.php...

CVE-2020-29177

CVE-2020-29177 affects Z-BlogPHP v1.6.1.2100, with an arbitrary file deletion vulnerability exploitable via the path \app_del.php. The connected documents consistently identify the affected software and the vulnerability class but do not provide deeper technical specifics about the root cause bey...

XStream: arbitrary file deletion on the local host via crafted input stream

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on...

Z-BlogPHP 安全漏洞

Z-BlogPHP is an open source PHP-based blogging system from the Z-blog community.Z-BlogPHP is vulnerable to an arbitrary file deletion vulnerability that stems from the inclusion of an arbitrary file deletion vulnerability via appdel.php. No detailed vulnerability details are currently available...

GHSA-8GW6-W5RW-4G5C Incorrect Default Permissions in Apache JSPWiki

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later...

Arbitrary file deletion

vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php...

DedeCMS authentication bypasses file deletion vulnerability

DedeCMS is a web management system. DedeCMS authentication bypasses file deletion vulnerability, which can be exploited to delete arbitrary files...

CVE-2021-44140

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later...

CVE-2021-44140

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later...

Design/Logic Flaw

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later...

CVE-2021-44140 Arbitrary file deletion on logout

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later...

XStream: arbitrary file deletion on the local host when unmarshalling

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executin...

XStream: arbitrary file deletion on the local host via crafted input stream

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on...

CVE-2020-7882

Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal charactersie. '../../../'...

Path traversal

Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal charactersie. '../../../'...

CVE-2020-7882

CVE-2020-7882 involves a path traversal in the getPFXFolderList parameter that can expose authorization certificate information and allow file deletion. Concrete details across connected sources confirm the vulnerability, including affected behavior and impact indicators (high confidentiality/int...

Hancom With AnySign4Pc 路径遍历漏洞

Hancom With AnySign4Pc is an executable .exe file from the South Korean company Hancom With. A path traversal vulnerability exists in Hancom With AnySign4Pc. The vulnerability stems from exploiting the parameters of the getPFXFolderList function, which allows an attacker to see authorization...

Lantronix PremierWave 2050 Path Traversal Vulnerability

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. The Lantronix PremierWave 2050 in version 8.9.0.0R4 contains a security vulnerability that stems from the Web Manager FsBrowseClean feature failing to properly filter special elements in resource or file...