Arbitrary file deletion

The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL...

Arbitrary File Deletion Vulnerability in SeaCMS Version v6.6.1

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. An arbitrary file deletion vulnerability exists in SeaCMS version v6.6.1, which can be exploited by an attacker to arbitrarily delete files...

Arbitrary File Deletion Vulnerability in TinyShop V3.1.1 E-Commerce System

TinyShop is an e-commerce system online store system based on the Tiny framework, suitable for businesses and individuals to quickly build a personalized online store. An arbitrary file deletion vulnerability exists in TinyShop V3.1.1 e-commerce system due to the system's failure to effectively...

Magento has multiple vulnerabilities

Magento is an open source PHP e-commerce system from Magento, which provides permission management, search engine and payment gateway. Magento suffers from HTML injection, multiple remote code execution, local file inclusion and arbitrary file deletion vulnerabilities. An attacker can steal...

Monstra CMS <= 3.0.4 Multiple Vulnerabilities

Monstra CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Directory Traversal

studio-42/elfinder is vulnerable to directory traversals. The application does not properly validate the file parameter in the zipdl function of elFinder.class.php, allowing a malicious user to conduct a directory traversals attack, and may cause file deletion. This vulnerability exists due to an...

Directory Traversal

studio-42/elfinder is vulnerable to directory traversals. The application does not validate the file parameter of the zipdl function in elFinder.class.php, allowing a malicious user to cause a directory traversal attack and may cause file deletion...

CVE-2018-4923

Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion...

Command injection

Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion...

CVE-2018-4923

Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion...

CVE-2018-4923

Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion...

CVE-2018-4923

CVE-2018-4923 affects Adobe Connect versions 9.7 and earlier. The vulnerability is an OS command injection in the Adobe Connect URI handler, enabling exploitation that could lead to arbitrary file deletion. Published references confirm this issue and connect it with APSB18-06 updates, which addre...

Advantech WebAccess Node webvrpcs drawsrv Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x2715 IOCTL in the webvrpcs process. The issue...

CVE-2018-1462

CVE-2018-1462 affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products. The issue allows an authenticated user to read/write system files they should not access, including deleting files or causing a denial of service. Affected products/versions includ...

CVE-2018-7495

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an external control of file name or path vulnerability has been identified...

CVE-2018-7495

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an external control of file name or path vulnerability has been identified...

CVE-2018-7495

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an external control of file name or path vulnerability has been identified...

WordPress Ultimate Member Plugin < 2.0.4 Multiple Vulnerabilities

The WordPress plugin Copyright C 2018 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

Advantech WebAccess

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Remotely exploitable/low skill level to exploit Vendor : Advantech Equipment : WebAccess Vulnerabilities : SQL Injection, Improper Authorization, Path Traversal, Heap-based Buffer Overflow, Stack-based Buffer Overflow, Untrusted Pointer Dereference,...

Multiple vulnerabilities in WordPress plugin "Ultimate Member"

Overview The WordPress plugin "Ultimate Member" provided by Ultimate Member contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2018-0585 Directory Traversal in the shortcodes function CWE-22 - CVE-2018-0586 Arbitrary File Upload CWE-434 - CVE-2018-0587 Directory...