CVE-2023-2909

CVE-2023-2909 describes a directory traversal vulnerability in the EZ Sync service of ASUSTOR ADM. The root cause is inadequate validation of user input, allowing an attacker to navigate outside the intended directory and delete files. Affected products/versions: ADM 4.0.6.REG2, 4.1.0 and earlier...

PT-2023-22137

Name of the Vulnerable Software and Affected Versions ADM versions 4.0.6.REG2 through 4.1.0 ADM versions 4.2.1.RGE2 and below Description The EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files...

CVE-2023-2909: Improper Limitation of a Pathname to a Restricted Directory

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below...

CVE-2022-39075: Undefined Security Weakness

There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could delete some system files without user permission...

CVE-2022-39075

There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could delete some system files without user permission...

CVE-2023-29380

Warpinator before 1.6.0 allows remote file deletion via directory traversal in topdirbasenames...

CVE-2023-29380

Warpinator before 1.6.0 allows remote file deletion via directory traversal in topdirbasenames...

Arbitrary file deletion

Warpinator before 1.6.0 allows remote file deletion via directory traversal in topdirbasenames...

CVE-2023-29380

Warpinator before 1.6.0 allows remote file deletion via directory traversal in topdirbasenames...

CVE-2023-29380

The CVE-2023-29380 vulnerability affects Warpinator prior to version 1.6.0 and is caused by a directory traversal in top_dir_basenames that enables remote deletion of files. The Red Hat/NVD entries confirm the issue and cite a fixed version (1.6.0). Impact is described as remote file deletion (ar...

CVE-2023-29380

Warpinator before 1.6.0 allows remote file deletion via directory traversal in topdirbasenames...

CVE-2023-29380

Warpinator before 1.6.0 allows remote file deletion via directory traversal in topdirbasenames...

CVE-2023-29380: Improper Limitation of a Pathname to a Restricted Directory

Warpinator before 1.6.0 allows remote file deletion via directory traversal in topdirbasenames...

CVE-2023-29380

Warpinator before 1.6.0 allows remote file deletion via directory traversal in topdirbasenames...

Arbitrary file deletion

Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php...

The vulnerability of the uploadMib function in the D-View 8 network device management platform allows a hacker to delete any files they desire.

The vulnerability of the uploadMib function in the D-View 8 network device management platform is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to delete any files they desire...

CVE-2023-2500

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'gopricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-lev...

CVE-2023-2500

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'gopricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-lev...

WordPress plugin Go Pricing - WordPress Responsive Pricing Tables 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Go Pricing -...

Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.6.6 - File Upload and File deletion via CSRF

The plugin is lacking CSRF and validation when uploading or deleting files, which could allow attackers to make a logged-in admin upload or delete files via a CSRF attack...