[SECURITY] [DLA 1673-1] wordpress security update

Package : wordpress Version : 4.1.25+dfsg-1+deb8u1 CVE ID : CVE-2018-20147 CVE-2018-20148 CVE-2018-20149 CVE-2018-20150 CVE-2018-20151 CVE-2018-20152 CVE-2018-20153 Debian Bug : 916403 CVE-2018-20147 Authors could modify metadata to bypass intended restrictions on deleting files. CVE-2018-20148...

Arbitrary File Modification

github.com/go-gitea/gitea is vulnerable to arbitrary file deletion. The vulnerability exists due to a lack of check on file path values, allowing DeleteFilePost to cause arbitrary deletion, and EditFilePost/UploadFilePost to cause arbitrary file modification...

The vulnerability of the fly-admin-dm graphical input configuration tool in the Astra Linux operating system allows a perpetrator to compromise the integrity and accessibility of protected data.

The vulnerability of the fly-admin-dm graphical input configuration tool in the Astra Linux operating system lies in the deletion of the original file when the copying of it to another partition is canceled. Exploiting this vulnerability allows a remote attacker to compromise the integrity and...

Arbitrary File Deletion Vulnerability in MetInfo Backend

MetInfo is a content management system CMS developed using PHP and Mysql by Changsha Mito Information Technology Co. There is an arbitrary file deletion vulnerability in the MetInfo backend, which can be exploited by an attacker to delete arbitrary files...

Vanilla: Unsanitized user photo paths allow local file read

Summary: When we register a new user, we can set the photo of user. If we set a milicious path, we can delete the profile photo of others Description: There is an episode of register. applications/dashboard/controllers/class.entrycontroller.php private function registerBasic $this-View =...

Design/Logic Flaw

An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor Versions 3.42 and prior through a specially crafted project file...

CVE-2018-19013

An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor Versions 3.42 and prior through a specially crafted project file...

CVE-2018-19013

An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor Versions 3.42 and prior through a specially crafted project file...

CVE-2018-19013

Omron CX-Supervisor CVE-2018-19013 affects CX-Supervisor versions 3.42 and earlier. The vulnerability arises from command injection during processing of a crafted project file, allowing an attacker to delete files or their contents on the device. Public details from connected sources describe exp...

Arbitrary File Deletion, File Read Vulnerability in Ectouch WechatController Backend

ECTouch is a mobile mall online store system launched by Shanghai Shangchuang Network Technology Co. Ectouch WechatController backend exists arbitrary file deletion, file reading vulnerability. Attackers can use the vulnerability to reinstall the system and obtain configuration files...

TAU Threat Intelligence Notification – MongoLock Ransomware

Summary The new variant of MongoLock Ransomware will delete users’ files immediately instead of encrypting them. Upon execution, MongoLock will scan specific locations such as Desktop, Documents, or Recycle Bin Folders, then delete files and format the local disk drives. The following is the list...

WordPress Automattic WooCommerce Plugin File Deletion Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up personal blog sites. automattic WooCommerce plugin is used in one of the e-commerce functionality of the plugin. logging system is one...

Oracle Java jnlp Protocol Directory Traversal Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of URIs...

CVE-2018-20714

The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate privileges to admin...

CVE-2018-20714

The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate privileges to admin...

CVE-2018-20714

The logging system of the Automattic WooCommerce plugin before 3.4.6 for WordPress is vulnerable to a File Deletion vulnerability. This allows deletion of woocommerce.php, which leads to certain privilege checks not being in place, and therefore a shop manager can escalate privileges to admin...

CVE-2018-20714

The CVE-2018-20714 entry concerns the WordPress WooCommerce plugin (pre-3.4.6). The vulnerability is a File Deletion flaw in the plugin’s logging system that allows deleting woocommerce.php, resulting in missing privilege checks and enabling a shop manager to escalate to administrator. Affected v...

DSShop open source single store mall system V1.5 there are arbitrary file deletion vulnerability

DSShop is based on ThinkPHP5 framework for the development of a single store mall system, full support for PC, WAP, microblogging and other terminal equipment, designed for business users to adapt to the entire business model of the solution, can fully meet the operational needs. DSShop open sour...

PEAR Archive_Tar < 1.4.4 - PHP Object Injection Vulnerability

Exploit for php platform in category web applications PEAR ArchiveTar temptarname will be called in the destructor method. If another class with useful gadget is loaded, remote code execution may be possible. Steps to reproduce object injection and arbitrary file deletion: 1. Make sure that PHP &...

CVE-2019-5887

An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not checked, resulting in input mishandling by the rmdir method. Attackers can delete arbitrary files by using "../" directory traversal...