AXIS Os Path Traversal Vulnerability

AXIS Os is an edge device operating system from AXIS of Sweden. AXIS Os has a security vulnerability that stems from the VAPIX API Manageoverlayimage.cgi is vulnerable to a path traversal attack that allows file/folder deletion. The flaw can only be exploited after authenticating with an operator...

CVE-2023-21417: Path Traversal: '.../...//'

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversal attacks that allows for file/folder deletion. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service...

CVE-2023-49105

ownCloud (owncloud/core) versions 10.6.0 through 10.13.0 are affected by an authentication bypass in the WebDAV API. Pre-signed URLs are accepted even when no signing-key is configured for the file owner (the default case), allowing an unauthenticated attacker to access, modify, or delete any fil...

PT-2023-7489 · Axis Communications · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS affected versions not specified Description: The VAPIX API irissetup.cgi is vulnerable to path traversal attacks, allowing for file deletion. This issue can only be exploited after authenticating with an operator- or...

CVE-2023-21418: Path Traversal: '.../...//'

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks that allows for file deletion. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. The impact...

WordPress CataBlog Plugin <= 1.7.0 is vulnerable to Arbitrary File Deletion

Software CataBlog Type Plugin Vulnerable versions = 1.7.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-47843 Patch priority Medium CVSS severity Medium 7.6 Developer Claim ownership PSID 9a8041fb49de Credits Rafie Muhammad Patchstack...

CVE-2023-42428

Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and files in the system...

CVE-2023-42428

Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and files in the system...

CVE-2023-42428: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and files in the system...

Vulnerabilities fixed in Fortinet FortiClient

Fortinet has fixed vulnerabilities in FortiClient. A local malicious party can exploit the vulnerabilities to gain elevated permissions, bypass security measures and via DDL hijacking or by deleting arbitrary files to alter the operation of the system on which FortiClient is installed. manipulate...

dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand

A vulnerability was found in FormatFtpCommand in the .NET package that may result in a CRLF injection arbitrary file write and deletion...

dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand

A vulnerability was found in FormatFtpCommand in the .NET package that may result in a CRLF injection arbitrary file write and deletion...

dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand

A vulnerability was found in FormatFtpCommand in the .NET package that may result in a CRLF injection arbitrary file write and deletion...

Arbitrary file deletion

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller use...

dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand

A vulnerability was found in FormatFtpCommand in the .NET package that may result in a CRLF injection arbitrary file write and deletion...

dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand

A vulnerability was found in FormatFtpCommand in the .NET package that may result in a CRLF injection arbitrary file write and deletion...

Xxe

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service...

CVE-2023-34982 AVEVA Operations Control Logger External Control of File Name or Path

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service...

CVE-2023-36049

A vulnerability was found in FormatFtpCommand in the .NET package that may result in a CRLF injection arbitrary file write and deletion. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease...

CVE-2023-34982: External Control of File Name or Path

This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service...