13352 matches found
HPESBNW04604 rev.2 - HPE Aruba ArubaOS, Multiple Vulnerabilities
Potential Security Impact: Local: Arbitrary File Deletion; Remote: Arbitrary Code Execution, Denial of Service DoS, Disclosure of Sensitive Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba SD-WAN Software and Gateways See vulnerability summary for details Aruba...
PT-2024-15844
Name of the Vulnerable Software and Affected Versions Vimeography: Vimeo Video Gallery WordPress Plugin versions up to, and including, 2.3.2 Description The issue allows authenticated attackers with contributor access or higher to inject a PHP Object via deserialization of untrusted input through...
openSUSE: Security Advisory for MozillaThunderbird (SUSE-SU-2023:3228-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cross Site Request Forgery (CSRF)
concrete5/concrete5 is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient validation in the /ccm/system/dialogs/file/delete/1/submit endpoint, allowing attackers to forge requests to delete files without proper authorization...
CVE-2023-48651
Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery CSRF at /ccm/system/dialogs/file/delete/1/submit...
PT-2024-5114 · Solarwinds · Solarwinds Access Rights Manager
Name of the Vulnerable Software and Affected Versions: SolarWinds Access Rights Manager affected versions not specified Description: The issue is related to the deleteTransferFile method in SolarWinds Access Rights Manager, which is vulnerable due to incorrect restriction of the directory path na...
CVE-2023-24416 WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7...
WordPress Plugin All In One Favicon Path Traversal Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in...
Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE
Summary A lack of sanitization/check in the font path returned by php-svg-lib, in the case of a inline CSS font defined, that will be used by Cpdf to open a font will be passed to a fileexists call, which is sufficient to trigger metadata unserializing on a PHAR file, through the phar:// URL...
GHSA-97M3-52WR-XVV2 Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE
Summary A lack of sanitization/check in the font path returned by php-svg-lib, in the case of a inline CSS font defined, that will be used by Cpdf to open a font will be passed to a fileexists call, which is sufficient to trigger metadata unserializing on a PHAR file, through the phar:// URL...
CVE-2024-25828
cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...
CVE-2024-25828
cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...
Arbitrary file deletion
cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...
SUSE-SU-2024:0587-1 Security update for docker
This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation bsc1219438. CVE-2024-23652: Fixed arbitrary deletion of files bsc1219268. CVE-2024-23651: Fixed rac...
SUSE-SU-2024:0586-1 Security update for docker
This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation bsc1219438. CVE-2024-23652: Fixed arbitrary deletion of files bsc1219268. CVE-2024-23651: Fixed rac...
cmseasy Security Vulnerabilities
CmsEasy is a content management system CMS for creating responsive websites from China's Kyushu Ecommerce Technology CmsEasy. A security vulnerability exists in cmseasy version V7.7.7.9, which originates from an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...
CVE-2024-25828: Path Traversal: 'dir/../../filename'
cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...
CVE-2024-25828
The cmseasy content management system (CMS), specifically version V7.7.7.9 , is vulnerable to an arbitrary file deletion vulnerability within the lib/admin/template_admin.php file. This security flaw is categorized as a Path Traversal (CWE-27) issue. The impact allows for the unauthorized deletio...
