12475 matches found
CVE-2024-33671
Summary: CVE-2024-33671 affects Veritas Backup Exec (before 22.2 HotFix 917391). The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to delete arbitrary files on protected files. Impact: highest concerns involve integrity and availability (I/H; A/H per metrics). Root cau...
CVE-2024-31551: Path Traversal: '/dir/../filename'
Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request...
PT-2024-25429 · Veritas · Veritas Backup Exec
Name of the Vulnerable Software and Affected Versions: Veritas Backup Exec versions prior to 22.2 HotFix 917391 Description: An issue was discovered in the Veritas Backup Exec software, where the Backup Exec Deduplication Multi-threaded Streaming Agent can be used to perform arbitrary file deleti...
CVE-2022-48682
In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink...
PT-2024-11774 · Fdupes +1 · Fdupes +1
Name of the Vulnerable Software and Affected Versions: FDUPES versions prior to 2.2.0 Description: A TOCTOU race condition in the deletefiles function allows for arbitrary file deletion via a symlink. Recommendations: For FDUPES versions prior to 2.2.0, update to version 2.2.0 or later to resolve...
CVE-2024-33672
An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged to perform arbitrary file deletion on protected files...
CVE-2024-33672
An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged to perform arbitrary file deletion on protected files...
CVE-2024-33671: External Control of File Name or Path
An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files...
CVE-2024-33672
CVE-2024-33672 affects Veritas NetBackup prior to 10.4. The Multi-Threaded Agent can be used to perform arbitrary file deletion on protected files, per multiple connected sources. Reported impact includes high confidentiality/availability implications (C/I = HIGH, A = HIGH) with local attack vect...
Ivanti Avalanche WLInfoRailService DELKEY Directory Traversal Arbitrary File Deletion Vulnerability
This vulnerability allows remote attackers to delete arbitrary files on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The specific flaw exists within the DELKEY command. The issue results from the lack of proper validation of a user-supplied...
Ivanti Avalanche WLAvalancheService Directory Traversal Arbitrary File Deletion Vulnerability
This vulnerability allows remote attackers to delete arbitrary files on affected installations of Ivanti Avalanche. Authentication is required to exploit this vulnerability. The specific flaw exists within the WLAvalancheService, which listens on TCP port 1777 by default. The issue results from t...
WordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerability
Arbitrary File Download and Deletion vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Sendinblue for WooCommerce versions = 4.0.17...
WordPress Contest Gallery plugin <= 21.3.4 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin Contest Gallery versions = 21.3.4...
WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary File Deletion vulnerability
Subscriber+ Arbitrary File Deletion vulnerability discovered by Dave Jong Patchstack in WordPress Plugin ARForms versions = 6.4...
WordPress Contest Gallery Plugin <= 21.3.4 is vulnerable to Arbitrary File Deletion
Software Contest Gallery Type Plugin Vulnerable versions = 21.3.4 Fixed in 21.3.5 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Deletion CVE CVE-2024-32778 Patch priority Medium CVSS severity Medium 8.5 Developer Wasiliy Strecker PSID 759fb50a3c46 Credits CatFather Required...
WordPress ARForms Plugin <= 6.4 is vulnerable to Arbitrary File Deletion
Software ARForms Type Plugin Vulnerable versions = 6.4 Fixed in 6.4.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-32703 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 3d075249b9fb Credits Dave Jong Patchstack Required...
PT-2024-6689 · Abb · Abb Aspect +2
Name of the Vulnerable Software and Affected Versions: ABB ASPECT - Enterprise versions 3.08.01 ABB NEXUS Series versions 3.08.01 ABB MATRIX Series versions 3.08.01 Description: An unauthorized file access issue exists in the WEB Server of ABB ASPECT - Enterprise, NEXUS Series, and MATRIX Series...
CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The...
CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The...
