Arbitrary file deletion vulnerability in scriptler

scriptler 342.v6a89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint. This allows attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system. scriptler 344.v5addb5f9e685 ensures that the file being deleted is...

CSRF vulnerability in htmlresource allows deleting arbitrary files

htmlresource 1.02 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete arbitrary files on the Jenkins controller file system. As of publication of this advisory, there is no fix...

CVE-2023-50764: Undefined Security Weakness

Jenkins Scriptler Plugin 342.v6a89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system...

Import and export users and customers < 1.24.3 - Admin+ Arbitrary File Read/Deletion

Description The plugin is vulnerable to Directory Traversal via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain...

Improper Link Resolution Before File Access (Leaky Vessels)

Overview Affected versions of this package are vulnerable to Improper Link Resolution Before File Access Leaky Vessels allowing arbitrary file deletion on the host system. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for th...

Code injection

Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link...

PYSEC-2023-292

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if...

CVE-2023-49797

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if...

CVE-2023-49797 Local Privilege Escalation in pyinstaller on Windows

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if...

Local Privilege Escalation in Windows

Impact A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: The user runs an application containing either...

PyInstaller Security Vulnerability

PyInstaller is a Python library from the Python Foundation that analyzes your code to discover all the other modules and libraries your scripts need to execute. A security vulnerability exists in PyInstaller versions prior to 5.13.1. An attacker exploiting this vulnerability could elevate...

CVE-2023-28868

The vulnerability CVE-2023-28868 affects NCP Secure Enterprise Client, specifically the Support Assistant component, and exists in versions prior to 12.22. The root cause is a flaw in the Support Assistant that enables an attacker to delete arbitrary files on the operating system by abusing symbo...

Structured Content < 1.6 - Contributor+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input. This makes it possible for attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an...

CVE-2023-28868: Improper Link Resolution Before File Access

Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link...

Arbitrary file deletion

An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file...

PT-2023-22017 · Ncp · Ncp Secure Enterprise Client

Name of the Vulnerable Software and Affected Versions: NCP Secure Enterprise Client versions prior to 12.22 Description: The issue allows attackers to delete arbitrary files on the operating system by creating a symbolic link. This is possible due to a flaw in the Support Assistant component of t...

The vulnerability of the Trend Micro Mobile Security software for mobile devices lies in its improper path name limitation for the restricted access directory, which allows a hacker to delete any files they want.

The vulnerability of the Trend Micro Mobile Security software relates to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files...

CVE-2023-49108

Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 excluding Ver.6.1.1.3a. If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges...

CVE-2023-49108: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 excluding Ver.6.1.1.3a. If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges...

VulnCheck KEV: CVE-2020-12832

WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input...