PT-2024-31991 · Mecha Cms · Mecha Cms

Name of the Vulnerable Software and Affected Versions: Mecha CMS version 3.0.0 Description: The issue allows an attacker to construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the deletion of arbitrary files or website...

CVE-2024-45894

BlueCMS 1.6 suffers from Arbitrary File Deletion via the filename parameter in an /admin/database.php?act=del request...

CVE-2024-45894

BlueCMS version 1.6 is vulnerable to Arbitrary File Deletion due to an insecure handling of the file_name parameter in the /admin/database.php?act=del request. This flaw allows an attacker to delete files on the server arbitrarily. As a temporary workaround, it is recommended to restrict access t...

CVE-2024-9314

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'setredirections' function. This makes it possible for authenticated attackers, with...

CVE-2024-20477 Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could...

CVE-2024-20477 Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability exists because of missing authorization controls on the affected REST API endpoint. An attacker could...

Exploit for Deserialization of Untrusted Data in Givewp

This post is a research article published by EQSTLabhttps://g...

PT-2024-38967

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to and including 3.16.1 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection due to the deserialization of...

ESET多款产品 安全漏洞

ESET Security Ultimate and others are products of ESET Slovakia.ESET Security Ultimate is a complete security solution.ESET NOD32 Antivirus is an antivirus program.ESET Internet Security is an advanced with anti-virus ESET Internet Security is an advanced antivirus program with antivirus features...

CVE-2024-8404

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege...

CVE-2024-8404

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege...

CVE-2024-8404 Arbitrary File Deletion in PaperCut NG/MF Web Print Hot folder

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege...

CVE-2024-8404

CVE-2024-8404 describes an arbitrary file deletion vulnerability in PaperCut NG/MF on Windows servers with Web Print enabled. An attacker must have local login access and be able to run low-privilege code via the web-print-hot-folder to delete targeted files. The issue is tied to a split from CVE...

PT-2024-39516 · Logsign · Logsign Unified Secops Platform

Name of the Vulnerable Software and Affected Versions: Logsign Unified SecOps Platform affected versions not specified Description: This issue allows remote attackers to delete arbitrary files within sensitive directories on affected installations of Logsign Unified SecOps Platform. Authenticatio...

Logsign Unified SecOps Platform delete_gsuite_key_file Input Validation Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files within sensitive directories on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the deletegsuitekeyfile endpoint. The issue...

Remote Code Execution

Camaleon CMS is vulnerable to Remote Code Execution. The vulnerability is due to insufficient path validation in the MediaController class, allowing attackers, after taking over an administrator account, to delete arbitrary files or folders. Additionally, the cropurl action may allow arbitrary fi...

WordPress plugin Prisna GWT 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

WordPress Contact Form 7 Campaign Monitor Extension plugin <= 0.4.67 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Contact Form 7 Campaign Monitor Extension versions = 0.4.67...

ABB Cylon Aspect 3.08.01 Arbitrary File Deletion

ABB Cylon Aspect 3.08.01 databaseFileDelete.php Arbitrary File Delete Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy...

WordPress WooEvents Plugin <= 4.1.2 is vulnerable to Arbitrary File Deletion

Software WooEvents Type Plugin Vulnerable versions = 4.1.2 Fixed in 4.1.3 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-8671 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 843e8b0d0dc5 Credits Tonn Required privilege...