WordPress Opal Woo Custom Product Variation Plugin <= 1.1.3 is vulnerable to Arbitrary File Deletion

Software Opal Woo Custom Product Variation Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2024-52444 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID aa758dfd0ef1 Credits...

WordPress Contact Page With Google Map Plugin <= 1.6.1 is vulnerable to Arbitrary File Deletion

Software Contact Page With Google Map Type Plugin Vulnerable versions = 1.6.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-52447 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 5441375409ba Credits Mika Required...

ManageEngine Endpoint Central < 11.3.2416.22 , 11.3.2428.x < 11.3.2428.10, 11.3.2435.x < 11.3.2435.1 Arbitrary File Deletion vulnerability

The version of ManageEngine Endpoint Central installed on the remote Windows host is either prior to 11.3.2416.22, 11.3.2428.10 or 11.3.2435.1. It is,therefore, affected by a Arbitrary File Deletion vulnerability. For more information, consult the vendor advisory. Note that Nessus has not tested...

CVE-2024-52371 WordPress Global Gateway e4 plugin <= 2.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway.This issue affects Global Gateway e4 | Payeezy Gateway: from n/a through 2.0...

CVE-2024-52371 WordPress Global Gateway e4 plugin <= 2.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway | globe-gateway-e4.This issue affects Global Gateway e4 | Payeezy Gateway |: from n/a through = 2.0...

CVE-2024-2552 PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall...

CVE-2024-2552

CVE-2024-2552 is described as a command-injection flaw in Palo Alto Networks PAN-OS that enables an authenticated administrator to bypass management-plane restrictions and delete files on the firewall. The Nessus/NVD entries reiterate an authenticated, local-access vulnerability; the PT-Security ...

CVE-2024-2552 PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall...

The vulnerability of the ManageEngine Endpoint Central MSP, a software solution for remote monitoring and management of desktop PCs, servers, laptops, and mobile devices, stems from insecure privilege management. This allows attackers to delete any files they desire.

The vulnerability of the ManageEngine Endpoint Central MSP, a software solution for remote monitoring and management of desktop PCs, servers, laptops, and mobile devices, lies in the insecure management of privileges. Exploiting this vulnerability could allow an attacker to delete any files they...

PT-2024-16666 · WordPress · Migration

Name of the Vulnerable Software and Affected Versions: Migration, Backup, Staging – WPvivid plugin for WordPress versions up to, and including, 0.9.107 Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted...

PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall. Work around: We strongly recommend customers to ensure access to your management interface is...

WordPress User Extra Fields plugin <= 16.6 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Chloe Chamberland in WordPress Plugin User Extra Fields versions = 16.6...

Arbitrary File Deletion

github.com/plentico/plenti is vulnerable to Arbitrary File Deletion. The vulnerability is due to insufficient input validation and lack of proper access controls on the /postLocal endpoint, allowing an attacker to manipulate file paths and trigger arbitrary file deletion when the Plenti user serv...

CVE-2024-11150

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletetmpuploadedfile function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files o...

CVE-2024-11150

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletetmpuploadedfile function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files o...

CVE-2024-11150 WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletetmpuploadedfile function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files o...

CVE-2024-11150 WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletetmpuploadedfile function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files o...

EUVD-2024-33676

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletetmpuploadedfile function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files o...

CVE-2024-11150

CVE-2024-11150 affects WordPress User Extra Fields (WordPress plugin). The issue is an unauthenticated arbitrary file deletion vulnerability caused by insufficient file path validation in delete_tmp_uploaded_file() across all versions up to and including 16.6. This could allow an unauthenticated ...

CVE-2024-10828

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for...