10714 matches found
Yxcms Arbitrary File Deletion Vulnerability
Yxcms is an enterprise building system based on PHP and mysql technology. Yxcms 1.4.6 version exists arbitrary file deletion vulnerability, attackers can use the vulnerability to delete files arbitrarily...
Arbitrary File Deletion Vulnerability in the Pelco Sarix Pro Webcam set_param Program
pelco Sarix Professional is a video camera. An arbitrary file deletion vulnerability exists in the pelco Sarix Pro webcam setparam program. The vulnerability is caused due to the program not checking filenames when processing parameters, which can be exploited by an attacker to delete arbitrary...
Arbitrary File Deletion Vulnerability in the Pelco Sarix Enhanced GeneralSetupController.php File
pelco Sarix Enhanced is a webcam. An arbitrary file deletion vulnerability exists in the pelco Sarix Enhanced GeneralSetupController.php file. The vulnerability is due to the program failing to properly check for uploaded files when processing them, an attacker can delete arbitrary files in the...
Huawei Reading App Arbitrary File Deletion Vulnerability
Huawei Read is the built-in mobile reading software for Huawei phones. The Huawei Reading App suffers from an arbitrary file deletion vulnerability, which is due to the software failing to adequately verify user-submitted input. An attacker could exploit the vulnerability to delete specific files...
The vulnerability of the microprogramming software of the Trend Micro Threat Discovery Appliance lies in the improper restriction on the path to the restricted access catalog. This allows a malicious actor to delete arbitrary files with root privileges, bypass authentication procedures, or cause service failures.
The vulnerability of the microprogramming software of the Trend Micro Threat Discovery Appliance exists due to an incorrect restriction on the path name to the restricted catalog during the processing of the sessionid parameter from the cookie file. Exploiting this vulnerability allows a maliciou...
CVE-2017-8133
Huawei iManager NetEco with software V600R008C00 and V600R008C10 has a command injection vulnerability. An authenticated, remote attacker could exploit this vulnerability to send malicious packets to a target device. Successful exploit could enable a low privileged user to execute commands that a...
CVE-2017-2691
Huawei P9 versions earlier before EVA-AL10C00B373, versions earlier before EVA-CL00C92B373, versions earlier before EVA-DL00C17B373, versions earlier before EVA-TL00C01B373 have a lock-screen bypass vulnerability. An unauthenticated attacker could force the phone to the fastboot mode and delete t...
WordPress: Arbitrary file deletion in wp-core - guides towards RCE and information disclosure
Vulnerable place 1: wp-admin/post.php $newmeta'thumb' is placed into DB not sanitized directly from user input. case 'editattachment': checkadminreferer'update-post' . $postid; // Don't let these be changed unset$POST'guid'; $POST'posttype' = 'attachment'; // Update the thumbnail filename $newmet...
Cisco Prime Network Analysis Module graph sfile Parameter Directory Traversal Arbitrary File Deletion Vulnerability
This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of Cisco Prime Network Analysis Module. Authentication is not required to exploit this vulnerability. The specific flaw exists within graph.php. When parsing the sfile parameter, the script does not...
Security Advisory - Multiple Security Vulnerabilities in Huawei iReader
Huawei iReader app has three security vulnerabilities. The app has an input validation vulnerability due to insufficient validation on the URL used for loading network data. An attacker can control app access and load malicious websites created by the attacker, and the code in webpages would be...
CVE-2017-16871
The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the pluploadaction function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross ...
Race condition
DISPUTED The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the pluploadaction function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does n...
CVE-2017-1000195
October CMS build 412 is vulnerable to PHP object injection in the asset move functionality, allowing an attacker to delete files on the server within the constraints of file permissions. The vulnerability is triggered through the asset handling path in October CMS, with documented remediation vi...
Arbitrary file deletion
A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the Server Message Block Version 2 SMB2 protocol. The vulnerability is due to the incorrect detection of an SMB2 fil...
Arbitrary file deletion
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability...
Symantec Endpoint Protection Arbitrary File Deletion Vulnerability (SYM17-011)
Symantec Endpoint Protection is prone to arbitrary file deletion vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Arbitrary file deletion vulnerability in database.php of Ubiquitous 365 website classification and navigation system
Uc365 website classification and navigation system is a cross-platform open source software, based on PHP + MYSQL development and construction of open source website classification and catalog management system. Uke365 website classification navigation system database.php arbitrary file deletion...
Symantec Endpoint Protection Arbitrary File Deletion Vulnerability
Symantec Endpoint Protection SEP is a suite of antivirus software from Symantec, USA. The software provides security across physical and virtual systems. A security vulnerability exists in Windows endpoint in versions prior to SEP 12.1 RU6 MP9 and versions prior to SEP 14 RU1. An attacker could...
CVE-2017-13680
Summary: CVE-2017-13680 affects Symantec Endpoint Protection (SEP) Windows endpoints. The vulnerability allows an attacker to perform unauthorized file deletions via the product UI. Affected versions are SEP 12.1 RU6 MP9 and SEP 14 RU1. Root cause/impact: UI-driven file deletion on the resident f...